git.sur5r.net Git - openldap/blob - servers/slapd/acl.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   4  *
   5  * Copyright 1998-2005 The OpenLDAP Foundation.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted only as authorized by the OpenLDAP
  10  * Public License.
  11  *
  12  * A copy of this license is available in the file LICENSE in the
  13  * top-level directory of the distribution or, alternatively, at
  14  * <http://www.OpenLDAP.org/license.html>.
  15  */
  16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
  17  * All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms are permitted
  20  * provided that this notice is preserved and that due credit is given
  21  * to the University of Michigan at Ann Arbor. The name of the University
  22  * may not be used to endorse or promote products derived from this
  23  * software without specific prior written permission. This software
  24  * is provided ``as is'' without express or implied warranty.
  25  */
  26
  27 #include "portable.h"
  28
  29 #include <stdio.h>
  30
  31 #include <ac/regex.h>
  32 #include <ac/socket.h>
  33 #include <ac/string.h>
  34
  35 #include "slap.h"
  36 #include "sets.h"
  37 #include "lber_pvt.h"
  38 #include "lutil.h"
  39
  40 #ifdef LDAP_SLAPI
  41 #include "slapi/slapi.h"
  42 #endif /* LDAPI_SLAPI */
  43
  44 #define ACL_BUF_SIZE    1024    /* use most appropriate size */
  45
  46 /*
  47  * speed up compares
  48  */
  49 static struct berval
  50         aci_bv_entry            = BER_BVC("entry"),
  51         aci_bv_children         = BER_BVC("children"),
  52         aci_bv_onelevel         = BER_BVC("onelevel"),
  53         aci_bv_subtree          = BER_BVC("subtree"),
  54         aci_bv_br_entry         = BER_BVC("[entry]"),
  55         aci_bv_br_all           = BER_BVC("[all]"),
  56         aci_bv_access_id        = BER_BVC("access-id"),
  57         aci_bv_anonymous        = BER_BVC("anonymous"),
  58         aci_bv_public           = BER_BVC("public"),
  59         aci_bv_users            = BER_BVC("users"),
  60         aci_bv_self             = BER_BVC("self"),
  61         aci_bv_dnattr           = BER_BVC("dnattr"),
  62         aci_bv_group            = BER_BVC("group"),
  63         aci_bv_role             = BER_BVC("role"),
  64         aci_bv_set              = BER_BVC("set"),
  65         aci_bv_set_ref          = BER_BVC("set-ref"),
  66         aci_bv_grant            = BER_BVC("grant"),
  67         aci_bv_deny             = BER_BVC("deny"),
  68
  69         aci_bv_ip_eq            = BER_BVC("IP="),
  70 #ifdef LDAP_PF_LOCAL
  71         aci_bv_path_eq          = BER_BVC("PATH="),
  72         aci_bv_dirsep           = BER_BVC(LDAP_DIRSEP),
  73 #endif /* LDAP_PF_LOCAL */
  74
  75         aci_bv_group_class      = BER_BVC(SLAPD_GROUP_CLASS),
  76         aci_bv_group_attr       = BER_BVC(SLAPD_GROUP_ATTR),
  77         aci_bv_role_class       = BER_BVC(SLAPD_ROLE_CLASS),
  78         aci_bv_role_attr        = BER_BVC(SLAPD_ROLE_ATTR),
  79         aci_bv_set_attr         = BER_BVC(SLAPD_ACI_SET_ATTR);
  80
  81 typedef enum slap_aci_scope_t {
  82         SLAP_ACI_SCOPE_ENTRY            = 0x1,
  83         SLAP_ACI_SCOPE_CHILDREN         = 0x2,
  84         SLAP_ACI_SCOPE_SUBTREE          = ( SLAP_ACI_SCOPE_ENTRY | SLAP_ACI_SCOPE_CHILDREN )
  85 } slap_aci_scope_t;
  86
  87 static AccessControl * acl_get(
  88         AccessControl *ac, int *count,
  89         Operation *op, Entry *e,
  90         AttributeDescription *desc,
  91         struct berval *val,
  92         int nmatch, regmatch_t *matches,
  93         AccessControlState *state );
  94
  95 static slap_control_t acl_mask(
  96         AccessControl *ac, slap_mask_t *mask,
  97         Operation *op, Entry *e,
  98         AttributeDescription *desc,
  99         struct berval *val,
 100         int nmatch,
 101         regmatch_t *matches,
 102         int count,
 103         AccessControlState *state );
 104
 105 #ifdef SLAPD_ACI_ENABLED
 106 static int aci_mask(
 107         Operation *op, Entry *e,
 108         AttributeDescription *desc,
 109         struct berval *val,
 110         struct berval *aci,
 111         int nmatch,
 112         regmatch_t *matches,
 113         slap_access_t *grant,
 114         slap_access_t *deny,
 115         slap_aci_scope_t scope);
 116 #endif
 117
 118 static int      regex_matches(
 119         struct berval *pat, char *str, char *buf,
 120         int nmatch, regmatch_t *matches);
 121 static int      string_expand(
 122         struct berval *newbuf, struct berval *pattern,
 123         char *match, int nmatch, regmatch_t *matches);
 124
 125 typedef struct AciSetCookie {
 126         Operation *op;
 127         Entry *e;
 128 } AciSetCookie;
 129
 130 SLAP_SET_GATHER aci_set_gather;
 131 SLAP_SET_GATHER aci_set_gather2;
 132 static int aci_match_set ( struct berval *subj, Operation *op,
 133     Entry *e, int setref );
 134
 135 /*
 136  * access_allowed - check whether op->o_ndn is allowed the requested access
 137  * to entry e, attribute attr, value val.  if val is null, access to
 138  * the whole attribute is assumed (all values).
 139  *
 140  * This routine loops through all access controls and calls
 141  * acl_mask() on each applicable access control.
 142  * The loop exits when a definitive answer is reached or
 143  * or no more controls remain.
 144  *
 145  * returns:
 146  *              0       access denied
 147  *              1       access granted
 148  *
 149  * Notes:
 150  * - can be legally called with op == NULL
 151  * - can be legally called with op->o_bd == NULL
 152  */
 153
 154 int
 155 access_allowed_mask(
 156         Operation               *op,
 157         Entry                   *e,
 158         AttributeDescription    *desc,
 159         struct berval           *val,
 160         slap_access_t           access,
 161         AccessControlState      *state,
 162         slap_mask_t             *maskp )
 163 {
 164         int                             ret = 1;
 165         int                             count;
 166         AccessControl                   *a = NULL;
 167         Backend *be;
 168         int     be_null = 0;
 169
 170 #ifdef LDAP_DEBUG
 171         char accessmaskbuf[ACCESSMASK_MAXLEN];
 172 #endif
 173         slap_mask_t mask;
 174         slap_control_t control;
 175         const char *attr;
 176         regmatch_t matches[MAXREMATCHES];
 177         int        st_same_attr = 0;
 178         static AccessControlState state_init = ACL_STATE_INIT;
 179
 180         assert( e != NULL );
 181         assert( desc != NULL );
 182         assert( access > ACL_NONE );
 183         if ( maskp ) ACL_INVALIDATE( *maskp );
 184
 185         attr = desc->ad_cname.bv_val;
 186
 187         assert( attr != NULL );
 188
 189         if( op && op->o_is_auth_check &&
 190                 ( access == ACL_SEARCH || access == ACL_READ ))
 191         {
 192                 access = ACL_AUTH;
 193         }
 194
 195         if( state ) {
 196                 if ( state->as_vd_ad==desc) {
 197                         if ( state->as_recorded ) {
 198                                 if( state->as_recorded & ACL_STATE_RECORDED_NV &&
 199                                         val == NULL )
 200                                 {
 201                                         return state->as_result;
 202                                 } else if ( state->as_recorded & ACL_STATE_RECORDED_VD &&
 203                                         val != NULL && state->as_vd_acl == NULL )
 204                                 {
 205                                         return state->as_result;
 206                                 }
 207                         }
 208                         st_same_attr = 1;
 209                 } else {
 210                         *state = state_init;
 211                 }
 212
 213                 state->as_vd_ad=desc;
 214         }
 215
 216         Debug( LDAP_DEBUG_ACL,
 217                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 218             access2str( access ), e->e_dn, attr );
 219
 220         if ( op == NULL ) {
 221                 /* no-op call */
 222                 goto done;
 223         }
 224
 225         be = op->o_bd;
 226         if ( be == NULL ) {
 227                 be = LDAP_STAILQ_FIRST(&backendDB);
 228                 be_null = 1;
 229 #ifdef LDAP_DEVEL
 230                 /*
 231                  * FIXME: experimental; use first backend rules
 232                  * iff there is no global_acl (ITS#3100) */
 233                 if ( frontendDB->be_acl == NULL )
 234 #endif
 235                 {
 236                         op->o_bd = be;
 237                 }
 238         }
 239         assert( be != NULL );
 240
 241 #ifdef LDAP_SLAPI
 242         if ( op->o_pb != NULL ) {
 243                 ret = slapi_int_access_allowed( op, e, desc, val, access, state );
 244                 if ( ret == 0 ) {
 245                         /* ACL plugin denied access */
 246                         goto done;
 247                 }
 248         }
 249 #endif /* LDAP_SLAPI */
 250
 251         /* grant database root access */
 252         if ( /* be != NULL && */ be_isroot( op ) ) {
 253                 Debug( LDAP_DEBUG_ACL,
 254                     "<= root access granted\n",
 255                         0, 0, 0 );
 256                 if ( maskp ) {
 257                         mask = ACL_LVL_MANAGE;
 258                 }
 259
 260                 goto done;
 261         }
 262
 263         /*
 264          * no-user-modification operational attributes are ignored
 265          * by ACL_WRITE checking as any found here are not provided
 266          * by the user
 267          */
 268         if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 269                 && desc != slap_schema.si_ad_entry
 270                 && desc != slap_schema.si_ad_children )
 271         {
 272                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 273                         " %s access granted\n",
 274                         attr, 0, 0 );
 275                 goto done;
 276         }
 277
 278         /* use backend default access if no backend acls */
 279         if( be != NULL && be->be_acl == NULL ) {
 280                 Debug( LDAP_DEBUG_ACL,
 281                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
 282                         access2str( access ),
 283                         be->be_dfltaccess >= access ? "granted" : "denied",
 284                         op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" );
 285                 ret = be->be_dfltaccess >= access;
 286
 287                 if ( maskp ) {
 288                         int     i;
 289
 290                         mask = ACL_PRIV_LEVEL;
 291                         for ( i = ACL_NONE; i <= be->be_dfltaccess; i++ ) {
 292                                 mask |= ACL_ACCESS2PRIV( i );
 293                         }
 294                 }
 295
 296                 goto done;
 297
 298 #ifdef notdef
 299         /* be is always non-NULL */
 300         /* use global default access if no global acls */
 301         } else if ( be == NULL && frontendDB->be_acl == NULL ) {
 302                 Debug( LDAP_DEBUG_ACL,
 303                         "=> access_allowed: global default %s access %s to \"%s\"\n",
 304                         access2str( access ),
 305                         frontendDB->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val );
 306                 ret = frontendDB->be_dfltaccess >= access;
 307
 308                 if ( maskp ) {
 309                         int     i;
 310
 311                         mask = ACL_PRIV_LEVEL;
 312                         for ( i = ACL_NONE; i <= global_default_access; i++ ) {
 313                                 mask |= ACL_ACCESS2PRIV( i );
 314                         }
 315                 }
 316
 317                 goto done;
 318 #endif
 319         }
 320
 321         ret = 0;
 322         control = ACL_BREAK;
 323
 324         if( st_same_attr ) {
 325                 assert( state->as_vd_acl != NULL );
 326
 327                 a = state->as_vd_acl;
 328                 count = state->as_vd_acl_count;
 329                 if ( !ACL_IS_INVALID( state->as_vd_acl_mask )) {
 330                         mask = state->as_vd_acl_mask;
 331                         AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
 332                         goto vd_access;
 333                 }
 334
 335         } else {
 336                 if ( state ) state->as_vi_acl = NULL;
 337                 a = NULL;
 338                 ACL_INIT(mask);
 339                 count = 0;
 340                 memset(matches, '\0', sizeof(matches));
 341         }
 342
 343         while((a = acl_get( a, &count, op, e, desc, val,
 344                 MAXREMATCHES, matches, state )) != NULL)
 345         {
 346                 int i;
 347
 348                 for (i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++) {
 349                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 350                             (int)matches[i].rm_so, (int)matches[i].rm_eo );
 351                         if( matches[i].rm_so <= matches[0].rm_eo ) {
 352                                 int n;
 353                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++) {
 354                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 355                                 }
 356                         }
 357                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 358                 }
 359
 360                 if (state) {
 361                         if (state->as_vi_acl == a && (state->as_recorded & ACL_STATE_RECORDED_NV)) {
 362                                 Debug( LDAP_DEBUG_ACL, "access_allowed: result from state (%s)\n", attr, 0, 0 );
 363                                 ret = state->as_result;
 364                                 goto done;
 365                         } else {
 366                                 Debug( LDAP_DEBUG_ACL, "access_allowed: no res from state (%s)\n", attr, 0, 0);
 367                         }
 368                 }
 369
 370 vd_access:
 371                 control = acl_mask( a, &mask, op,
 372                         e, desc, val, MAXREMATCHES, matches, count, state );
 373
 374                 if ( control != ACL_BREAK ) {
 375                         break;
 376                 }
 377
 378                 memset(matches, '\0', sizeof(matches));
 379         }
 380
 381         if ( ACL_IS_INVALID( mask ) ) {
 382                 Debug( LDAP_DEBUG_ACL,
 383                         "=> access_allowed: \"%s\" (%s) invalid!\n",
 384                         e->e_dn, attr, 0 );
 385                 ACL_INIT(mask);
 386
 387         } else if ( control == ACL_BREAK ) {
 388                 Debug( LDAP_DEBUG_ACL,
 389                         "=> access_allowed: no more rules\n", 0, 0, 0);
 390
 391                 goto done;
 392         }
 393
 394         Debug( LDAP_DEBUG_ACL,
 395                 "=> access_allowed: %s access %s by %s\n",
 396                 access2str( access ),
 397                 ACL_GRANT(mask, access) ? "granted" : "denied",
 398                 accessmask2str( mask, accessmaskbuf, 1 ) );
 399
 400         ret = ACL_GRANT(mask, access);
 401
 402 done:
 403         if( state != NULL ) {
 404                 /* If not value-dependent, save ACL in case of more attrs */
 405                 if ( !(state->as_recorded & ACL_STATE_RECORDED_VD) ) {
 406                         state->as_vi_acl = a;
 407                         state->as_result = ret;
 408                 }
 409                 state->as_recorded |= ACL_STATE_RECORDED;
 410         }
 411         if (be_null) op->o_bd = NULL;
 412         if ( maskp ) *maskp = mask;
 413         return ret;
 414 }
 415
 416
 417 /*
 418  * acl_get - return the acl applicable to entry e, attribute
 419  * attr.  the acl returned is suitable for use in subsequent calls to
 420  * acl_access_allowed().
 421  */
 422
 423 static AccessControl *
 424 acl_get(
 425         AccessControl *a,
 426         int                     *count,
 427         Operation       *op,
 428         Entry           *e,
 429         AttributeDescription *desc,
 430         struct berval   *val,
 431         int                     nmatch,
 432         regmatch_t      *matches,
 433         AccessControlState *state )
 434 {
 435         const char *attr;
 436         int dnlen, patlen;
 437         AccessControl *prev;
 438
 439         assert( e != NULL );
 440         assert( count != NULL );
 441         assert( desc != NULL );
 442
 443         attr = desc->ad_cname.bv_val;
 444
 445         assert( attr != NULL );
 446
 447         if( a == NULL ) {
 448                 if( op->o_bd == NULL ) {
 449                         a = frontendDB->be_acl;
 450                 } else {
 451                         a = op->o_bd->be_acl;
 452                 }
 453                 prev = NULL;
 454
 455                 assert( a != NULL );
 456
 457         } else {
 458                 prev = a;
 459                 a = a->acl_next;
 460         }
 461
 462         dnlen = e->e_nname.bv_len;
 463
 464         for ( ; a != NULL; a = a->acl_next ) {
 465                 (*count) ++;
 466
 467                 if ( a->acl_dn_pat.bv_len || ( a->acl_dn_style != ACL_STYLE_REGEX )) {
 468                         if ( a->acl_dn_style == ACL_STYLE_REGEX ) {
 469                                 Debug( LDAP_DEBUG_ACL, "=> dnpat: [%d] %s nsub: %d\n",
 470                                         *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub );
 471                                 if (regexec(&a->acl_dn_re, e->e_ndn, nmatch, matches, 0))
 472                                         continue;
 473
 474                         } else {
 475                                 Debug( LDAP_DEBUG_ACL, "=> dn: [%d] %s\n",
 476                                         *count, a->acl_dn_pat.bv_val, 0 );
 477                                 patlen = a->acl_dn_pat.bv_len;
 478                                 if ( dnlen < patlen )
 479                                         continue;
 480
 481                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 482                                         /* base dn -- entire object DN must match */
 483                                         if ( dnlen != patlen )
 484                                                 continue;
 485
 486                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 487                                         int     rdnlen = -1, sep = 0;
 488
 489                                         if ( dnlen <= patlen )
 490                                                 continue;
 491
 492                                         if ( patlen > 0 ) {
 493                                                 if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 494                                                         continue;
 495                                                 sep = 1;
 496                                         }
 497
 498                                         rdnlen = dn_rdnlen( NULL, &e->e_nname );
 499                                         if ( rdnlen != dnlen - patlen - sep )
 500                                                 continue;
 501
 502                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 503                                         if ( dnlen > patlen && !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 504                                                 continue;
 505
 506                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 507                                         if ( dnlen <= patlen )
 508                                                 continue;
 509                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) )
 510                                                 continue;
 511                                 }
 512
 513                                 if ( strcmp( a->acl_dn_pat.bv_val, e->e_ndn + dnlen - patlen ) != 0 )
 514                                         continue;
 515                         }
 516
 517                         Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] matched\n",
 518                                 *count, 0, 0 );
 519                 }
 520
 521                 if ( a->acl_attrs && !ad_inlist( desc, a->acl_attrs ) ) {
 522                         matches[0].rm_so = matches[0].rm_eo = -1;
 523                         continue;
 524                 }
 525
 526                 /* Is this ACL only for a specific value? */
 527                 if ( a->acl_attrval.bv_len ) {
 528                         if ( val == NULL ) {
 529                                 continue;
 530                         }
 531
 532                         if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) {
 533                                 state->as_recorded |= ACL_STATE_RECORDED_VD;
 534                                 state->as_vd_acl = prev;
 535                                 state->as_vd_acl_count = *count;
 536                                 state->as_vd_access = a->acl_access;
 537                                 state->as_vd_access_count = 1;
 538                                 ACL_INVALIDATE( state->as_vd_acl_mask );
 539                         }
 540
 541                         if ( a->acl_attrval_style == ACL_STYLE_REGEX ) {
 542                                 Debug( LDAP_DEBUG_ACL,
 543                                         "acl_get: valpat %s\n",
 544                                         a->acl_attrval.bv_val, 0, 0 );
 545                                 if ( regexec( &a->acl_attrval_re, val->bv_val, 0, NULL, 0 ) )
 546                                 {
 547                                         continue;
 548                                 }
 549
 550                         } else {
 551                                 int match = 0;
 552                                 const char *text;
 553                                 Debug( LDAP_DEBUG_ACL,
 554                                         "acl_get: val %s\n",
 555                                         a->acl_attrval.bv_val, 0, 0 );
 556
 557                                 if ( a->acl_attrs[0].an_desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) {
 558                                         if (value_match( &match, desc,
 559                                                 desc->ad_type->sat_equality, 0,
 560                                                 val, &a->acl_attrval, &text ) != LDAP_SUCCESS ||
 561                                                         match )
 562                                                 continue;
 563
 564                                 } else {
 565                                         int             patlen, vdnlen;
 566
 567                                         patlen = a->acl_attrval.bv_len;
 568                                         vdnlen = val->bv_len;
 569
 570                                         if ( vdnlen < patlen )
 571                                                 continue;
 572
 573                                         if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 574                                                 if ( vdnlen > patlen )
 575                                                         continue;
 576
 577                                         } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 578                                                 int rdnlen = -1;
 579
 580                                                 if ( !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
 581                                                         continue;
 582
 583                                                 rdnlen = dn_rdnlen( NULL, val );
 584                                                 if ( rdnlen != vdnlen - patlen - 1 )
 585                                                         continue;
 586
 587                                         } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 588                                                 if ( vdnlen > patlen && !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
 589                                                         continue;
 590
 591                                         } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 592                                                 if ( vdnlen <= patlen )
 593                                                         continue;
 594
 595                                                 if ( !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
 596                                                         continue;
 597                                         }
 598
 599                                         if ( strcmp( a->acl_attrval.bv_val, val->bv_val + vdnlen - patlen ))
 600                                                 continue;
 601                                 }
 602                         }
 603                 }
 604
 605                 if ( a->acl_filter != NULL ) {
 606                         ber_int_t rc = test_filter( NULL, e, a->acl_filter );
 607                         if ( rc != LDAP_COMPARE_TRUE ) {
 608                                 continue;
 609                         }
 610                 }
 611
 612                 Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] attr %s\n",
 613                        *count, attr, 0);
 614                 return a;
 615         }
 616
 617         Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
 618         return( NULL );
 619 }
 620
 621 static int
 622 acl_mask_dn(
 623         Operation               *op,
 624         Entry                   *e,
 625         AccessControl           *a,
 626         int                     nmatch,
 627         regmatch_t              *matches,
 628         slap_dn_access          *b,
 629         struct berval           *opndn )
 630 {
 631         /*
 632          * if access applies to the entry itself, and the
 633          * user is bound as somebody in the same namespace as
 634          * the entry, OR the given dn matches the dn pattern
 635          */
 636         /*
 637          * NOTE: styles "anonymous", "users" and "self"
 638          * have been moved to enum slap_style_t, whose
 639          * value is set in a_dn_style; however, the string
 640          * is maintaned in a_dn_pat.
 641          */
 642         if ( b->a_style == ACL_STYLE_ANONYMOUS ) {
 643                 if ( !BER_BVISEMPTY( opndn ) ) {
 644                         return 1;
 645                 }
 646
 647         } else if ( b->a_style == ACL_STYLE_USERS ) {
 648                 if ( BER_BVISEMPTY( opndn ) ) {
 649                         return 1;
 650                 }
 651
 652         } else if ( b->a_style == ACL_STYLE_SELF ) {
 653                 struct berval   ndn, selfndn;
 654                 int             level;
 655
 656                 if ( BER_BVISEMPTY( opndn ) || BER_BVISNULL( &e->e_nname ) ) {
 657                         return 1;
 658                 }
 659
 660                 level = b->a_self_level;
 661                 if ( level < 0 ) {
 662                         selfndn = *opndn;
 663                         ndn = e->e_nname;
 664                         level = -level;
 665
 666                 } else {
 667                         ndn = *opndn;
 668                         selfndn = e->e_nname;
 669                 }
 670
 671                 for ( ; level > 0; level-- ) {
 672                         if ( BER_BVISEMPTY( &ndn ) ) {
 673                                 break;
 674                         }
 675                         dnParent( &ndn, &ndn );
 676                 }
 677
 678                 if ( BER_BVISEMPTY( &ndn ) || !dn_match( &ndn, &selfndn ) )
 679                 {
 680                         return 1;
 681                 }
 682
 683         } else if ( b->a_style == ACL_STYLE_REGEX ) {
 684                 if ( !ber_bvccmp( &b->a_pat, '*' ) ) {
 685                         int             tmp_nmatch;
 686                         regmatch_t      tmp_matches[2],
 687                                         *tmp_matchesp = tmp_matches;
 688
 689                         int             rc = 0;
 690
 691                         switch ( a->acl_dn_style ) {
 692                         case ACL_STYLE_REGEX:
 693                                 if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
 694                                         tmp_matchesp = matches;
 695                                         tmp_nmatch = nmatch;
 696                                         break;
 697                                 }
 698                         /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
 699
 700                         case ACL_STYLE_BASE:
 701                                 tmp_matches[0].rm_so = 0;
 702                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
 703                                 tmp_nmatch = 1;
 704                                 break;
 705
 706                         case ACL_STYLE_ONE:
 707                         case ACL_STYLE_SUBTREE:
 708                         case ACL_STYLE_CHILDREN:
 709                                 tmp_matches[0].rm_so = 0;
 710                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
 711                                 tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
 712                                 tmp_matches[1].rm_eo = e->e_nname.bv_len;
 713                                 tmp_nmatch = 2;
 714                                 break;
 715
 716                         default:
 717                                 /* error */
 718                                 rc = 1;
 719                                 break;
 720                         }
 721
 722                         if ( rc ) {
 723                                 return 1;
 724                         }
 725
 726                         if ( !regex_matches( &b->a_pat, opndn->bv_val,
 727                                 e->e_ndn, tmp_nmatch, tmp_matchesp ) )
 728                         {
 729                                 return 1;
 730                         }
 731                 }
 732
 733         } else {
 734                 struct berval   pat;
 735                 ber_len_t       patlen, odnlen;
 736                 int             got_match = 0;
 737
 738                 if ( e->e_dn == NULL )
 739                         return 1;
 740
 741                 if ( b->a_expand ) {
 742                         struct berval   bv;
 743                         char            buf[ACL_BUF_SIZE];
 744
 745                         int             tmp_nmatch;
 746                         regmatch_t      tmp_matches[2],
 747                                         *tmp_matchesp = tmp_matches;
 748
 749                         int             rc = 0;
 750
 751                         bv.bv_len = sizeof( buf ) - 1;
 752                         bv.bv_val = buf;
 753
 754                         switch ( a->acl_dn_style ) {
 755                         case ACL_STYLE_REGEX:
 756                                 if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
 757                                         tmp_matchesp = matches;
 758                                         tmp_nmatch = nmatch;
 759                                         break;
 760                                 }
 761                         /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
 762
 763                         case ACL_STYLE_BASE:
 764                                 tmp_matches[0].rm_so = 0;
 765                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
 766                                 tmp_nmatch = 1;
 767                                 break;
 768
 769                         case ACL_STYLE_ONE:
 770                         case ACL_STYLE_SUBTREE:
 771                         case ACL_STYLE_CHILDREN:
 772                                 tmp_matches[0].rm_so = 0;
 773                                 tmp_matches[0].rm_eo = e->e_nname.bv_len;
 774                                 tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
 775                                 tmp_matches[1].rm_eo = e->e_nname.bv_len;
 776                                 tmp_nmatch = 2;
 777                                 break;
 778
 779                         default:
 780                                 /* error */
 781                                 rc = 1;
 782                                 break;
 783                         }
 784
 785                         if ( rc ) {
 786                                 return 1;
 787                         }
 788
 789                         if ( string_expand( &bv, &b->a_pat,
 790                                         e->e_nname.bv_val,
 791                                         tmp_nmatch, tmp_matchesp ) )
 792                         {
 793                                 return 1;
 794                         }
 795
 796                         if ( dnNormalize(0, NULL, NULL, &bv,
 797                                         &pat, op->o_tmpmemctx )
 798                                         != LDAP_SUCCESS )
 799                         {
 800                                 /* did not expand to a valid dn */
 801                                 return 1;
 802                         }
 803
 804                 } else {
 805                         pat = b->a_pat;
 806                 }
 807
 808                 patlen = pat.bv_len;
 809                 odnlen = opndn->bv_len;
 810                 if ( odnlen < patlen ) {
 811                         goto dn_match_cleanup;
 812
 813                 }
 814
 815                 if ( b->a_style == ACL_STYLE_BASE ) {
 816                         /* base dn -- entire object DN must match */
 817                         if ( odnlen != patlen ) {
 818                                 goto dn_match_cleanup;
 819                         }
 820
 821                 } else if ( b->a_style == ACL_STYLE_ONE ) {
 822                         int rdnlen = -1;
 823
 824                         if ( odnlen <= patlen ) {
 825                                 goto dn_match_cleanup;
 826                         }
 827
 828                         if ( !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
 829                                 goto dn_match_cleanup;
 830                         }
 831
 832                         rdnlen = dn_rdnlen( NULL, opndn );
 833                         if ( rdnlen != odnlen - patlen - 1 ) {
 834                                 goto dn_match_cleanup;
 835                         }
 836
 837                 } else if ( b->a_style == ACL_STYLE_SUBTREE ) {
 838                         if ( odnlen > patlen && !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
 839                                 goto dn_match_cleanup;
 840                         }
 841
 842                 } else if ( b->a_style == ACL_STYLE_CHILDREN ) {
 843                         if ( odnlen <= patlen ) {
 844                                 goto dn_match_cleanup;
 845                         }
 846
 847                         if ( !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
 848                                 goto dn_match_cleanup;
 849                         }
 850
 851                 } else if ( b->a_style == ACL_STYLE_LEVEL ) {
 852                         int level;
 853                         struct berval ndn;
 854
 855                         if ( odnlen <= patlen ) {
 856                                 goto dn_match_cleanup;
 857                         }
 858
 859                         if ( level > 0 && !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) )
 860                         {
 861                                 goto dn_match_cleanup;
 862                         }
 863
 864                         level = b->a_level;
 865                         ndn = *opndn;
 866                         for ( ; level > 0; level-- ) {
 867                                 if ( BER_BVISEMPTY( &ndn ) ) {
 868                                         goto dn_match_cleanup;
 869                                 }
 870                                 dnParent( &ndn, &ndn );
 871                                 if ( ndn.bv_len < patlen ) {
 872                                         goto dn_match_cleanup;
 873                                 }
 874                         }
 875
 876                         if ( ndn.bv_len != patlen ) {
 877                                 goto dn_match_cleanup;
 878                         }
 879                 }
 880
 881                 got_match = !strcmp( pat.bv_val, &opndn->bv_val[ odnlen - patlen ] );
 882
 883 dn_match_cleanup:;
 884                 if ( pat.bv_val != b->a_pat.bv_val ) {
 885                         slap_sl_free( pat.bv_val, op->o_tmpmemctx );
 886                 }
 887
 888                 if ( !got_match ) {
 889                         return 1;
 890                 }
 891         }
 892
 893         return 0;
 894 }
 895
 896 /*
 897  * Record value-dependent access control state
 898  */
 899 #define ACL_RECORD_VALUE_STATE do { \
 900                 if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) { \
 901                         state->as_recorded |= ACL_STATE_RECORDED_VD; \
 902                         state->as_vd_acl = a; \
 903                         AC_MEMCPY( state->as_vd_acl_matches, matches, \
 904                                 sizeof( state->as_vd_acl_matches )) ; \
 905                         state->as_vd_acl_count = count; \
 906                         state->as_vd_access = b; \
 907                         state->as_vd_access_count = i; \
 908                 } \
 909         } while( 0 )
 910
 911 static int
 912 acl_mask_dnattr(
 913         Operation               *op,
 914         Entry                   *e,
 915         struct berval           *val,
 916         AccessControl           *a,
 917         Access                  *b,
 918         int                     i,
 919         regmatch_t              *matches,
 920         int                     count,
 921         AccessControlState      *state,
 922         slap_dn_access          *bdn,
 923         struct berval           *opndn )
 924 {
 925         Attribute       *at;
 926         struct berval   bv;
 927         int             rc, match = 0;
 928         const char      *text;
 929         const char      *attr = bdn->a_at->ad_cname.bv_val;
 930
 931         assert( attr != NULL );
 932
 933         if ( BER_BVISEMPTY( opndn ) ) {
 934                 return 1;
 935         }
 936
 937         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n", attr, 0, 0 );
 938         bv = *opndn;
 939
 940         /* see if asker is listed in dnattr */
 941         for ( at = attrs_find( e->e_attrs, bdn->a_at );
 942                 at != NULL;
 943                 at = attrs_find( at->a_next, bdn->a_at ) )
 944         {
 945                 if ( value_find_ex( bdn->a_at,
 946                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
 947                                 SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
 948                         at->a_nvals,
 949                         &bv, op->o_tmpmemctx ) == 0 )
 950                 {
 951                         /* found it */
 952                         match = 1;
 953                         break;
 954                 }
 955         }
 956
 957         if ( match ) {
 958                 /* have a dnattr match. if this is a self clause then
 959                  * the target must also match the op dn.
 960                  */
 961                 if ( bdn->a_self ) {
 962                         /* check if the target is an attribute. */
 963                         if ( val == NULL ) return 1;
 964
 965                         /* target is attribute, check if the attribute value
 966                          * is the op dn.
 967                          */
 968                         rc = value_match( &match, bdn->a_at,
 969                                 bdn->a_at->ad_type->sat_equality, 0,
 970                                 val, &bv, &text );
 971                         /* on match error or no match, fail the ACL clause */
 972                         if ( rc != LDAP_SUCCESS || match != 0 )
 973                                 return 1;
 974                 }
 975
 976         } else {
 977                 /* no dnattr match, check if this is a self clause */
 978                 if ( ! bdn->a_self )
 979                         return 1;
 980
 981                 ACL_RECORD_VALUE_STATE;
 982
 983                 /* this is a self clause, check if the target is an
 984                  * attribute.
 985                  */
 986                 if ( val == NULL )
 987                         return 1;
 988
 989                 /* target is attribute, check if the attribute value
 990                  * is the op dn.
 991                  */
 992                 rc = value_match( &match, bdn->a_at,
 993                         bdn->a_at->ad_type->sat_equality, 0,
 994                         val, &bv, &text );
 995
 996                 /* on match error or no match, fail the ACL clause */
 997                 if ( rc != LDAP_SUCCESS || match != 0 )
 998                         return 1;
 999         }
1000
1001         return 0;
1002 }
1003
1004
1005 /*
1006  * acl_mask - modifies mask based upon the given acl and the
1007  * requested access to entry e, attribute attr, value val.  if val
1008  * is null, access to the whole attribute is assumed (all values).
1009  *
1010  * returns      0       access NOT allowed
1011  *              1       access allowed
1012  */
1013
1014 static slap_control_t
1015 acl_mask(
1016         AccessControl           *a,
1017         slap_mask_t             *mask,
1018         Operation               *op,
1019         Entry                   *e,
1020         AttributeDescription    *desc,
1021         struct berval           *val,
1022         int                     nmatch,
1023         regmatch_t              *matches,
1024         int                     count,
1025         AccessControlState      *state )
1026 {
1027         int             i;
1028         Access  *b;
1029 #ifdef LDAP_DEBUG
1030         char accessmaskbuf[ACCESSMASK_MAXLEN];
1031 #if !defined( SLAP_DYNACL ) && defined( SLAPD_ACI_ENABLED )
1032         char accessmaskbuf1[ACCESSMASK_MAXLEN];
1033 #endif /* SLAPD_ACI_ENABLED */
1034 #endif /* DEBUG */
1035         const char *attr;
1036
1037         assert( a != NULL );
1038         assert( mask != NULL );
1039         assert( desc != NULL );
1040
1041         attr = desc->ad_cname.bv_val;
1042
1043         assert( attr != NULL );
1044
1045         Debug( LDAP_DEBUG_ACL,
1046                 "=> acl_mask: access to entry \"%s\", attr \"%s\" requested\n",
1047                 e->e_dn, attr, 0 );
1048
1049         Debug( LDAP_DEBUG_ACL,
1050                 "=> acl_mask: to %s by \"%s\", (%s) \n",
1051                 val ? "value" : "all values",
1052                 op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
1053                 accessmask2str( *mask, accessmaskbuf, 1) );
1054
1055
1056         if( state && ( state->as_recorded & ACL_STATE_RECORDED_VD )
1057                 && state->as_vd_acl == a )
1058         {
1059                 b = state->as_vd_access;
1060                 i = state->as_vd_access_count;
1061
1062         } else {
1063                 b = a->acl_access;
1064                 i = 1;
1065         }
1066
1067         for ( ; b != NULL; b = b->a_next, i++ ) {
1068                 slap_mask_t oldmask, modmask;
1069
1070                 ACL_INVALIDATE( modmask );
1071
1072                 /* AND <who> clauses */
1073                 if ( !BER_BVISEMPTY( &b->a_dn_pat ) ) {
1074                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
1075                                 b->a_dn_pat.bv_val, 0, 0);
1076                         /*
1077                          * if access applies to the entry itself, and the
1078                          * user is bound as somebody in the same namespace as
1079                          * the entry, OR the given dn matches the dn pattern
1080                          */
1081                         /*
1082                          * NOTE: styles "anonymous", "users" and "self"
1083                          * have been moved to enum slap_style_t, whose
1084                          * value is set in a_dn_style; however, the string
1085                          * is maintaned in a_dn_pat.
1086                          */
1087
1088                         if ( acl_mask_dn( op, e, a, nmatch, matches,
1089                                 &b->a_dn, &op->o_ndn ) )
1090                         {
1091                                 continue;
1092                         }
1093                 }
1094
1095                 if ( !BER_BVISEMPTY( &b->a_realdn_pat ) ) {
1096                         struct berval   ndn;
1097
1098                         Debug( LDAP_DEBUG_ACL, "<= check a_realdn_pat: %s\n",
1099                                 b->a_realdn_pat.bv_val, 0, 0);
1100                         /*
1101                          * if access applies to the entry itself, and the
1102                          * user is bound as somebody in the same namespace as
1103                          * the entry, OR the given dn matches the dn pattern
1104                          */
1105                         /*
1106                          * NOTE: styles "anonymous", "users" and "self"
1107                          * have been moved to enum slap_style_t, whose
1108                          * value is set in a_dn_style; however, the string
1109                          * is maintaned in a_dn_pat.
1110                          */
1111
1112                         if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) ) {
1113                                 ndn = op->o_conn->c_ndn;
1114                         } else {
1115                                 ndn = op->o_ndn;
1116                         }
1117
1118                         if ( acl_mask_dn( op, e, a, nmatch, matches,
1119                                 &b->a_realdn, &ndn ) )
1120                         {
1121                                 continue;
1122                         }
1123                 }
1124
1125                 if ( !BER_BVISEMPTY( &b->a_sockurl_pat ) ) {
1126                         if ( ! op->o_conn->c_listener ) {
1127                                 continue;
1128                         }
1129                         Debug( LDAP_DEBUG_ACL, "<= check a_sockurl_pat: %s\n",
1130                                 b->a_sockurl_pat.bv_val, 0, 0 );
1131
1132                         if ( !ber_bvccmp( &b->a_sockurl_pat, '*' ) ) {
1133                                 if ( b->a_sockurl_style == ACL_STYLE_REGEX) {
1134                                         if (!regex_matches( &b->a_sockurl_pat, op->o_conn->c_listener_url.bv_val,
1135                                                         e->e_ndn, nmatch, matches ) )
1136                                         {
1137                                                 continue;
1138                                         }
1139
1140                                 } else if ( b->a_sockurl_style == ACL_STYLE_EXPAND ) {
1141                                         struct berval   bv;
1142                                         char buf[ACL_BUF_SIZE];
1143
1144                                         bv.bv_len = sizeof( buf ) - 1;
1145                                         bv.bv_val = buf;
1146                                         if ( string_expand( &bv, &b->a_sockurl_pat,
1147                                                         e->e_ndn, nmatch, matches ) )
1148                                         {
1149                                                 continue;
1150                                         }
1151
1152                                         if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_listener_url ) != 0 )
1153                                         {
1154                                                 continue;
1155                                         }
1156
1157                                 } else {
1158                                         if ( ber_bvstrcasecmp( &b->a_sockurl_pat, &op->o_conn->c_listener_url ) != 0 )
1159                                         {
1160                                                 continue;
1161                                         }
1162                                 }
1163                         }
1164                 }
1165
1166                 if ( !BER_BVISEMPTY( &b->a_domain_pat ) ) {
1167                         if ( !op->o_conn->c_peer_domain.bv_val ) {
1168                                 continue;
1169                         }
1170                         Debug( LDAP_DEBUG_ACL, "<= check a_domain_pat: %s\n",
1171                                 b->a_domain_pat.bv_val, 0, 0 );
1172                         if ( !ber_bvccmp( &b->a_domain_pat, '*' ) ) {
1173                                 if ( b->a_domain_style == ACL_STYLE_REGEX) {
1174                                         if (!regex_matches( &b->a_domain_pat, op->o_conn->c_peer_domain.bv_val,
1175                                                         e->e_ndn, nmatch, matches ) )
1176                                         {
1177                                                 continue;
1178                                         }
1179                                 } else {
1180                                         char buf[ACL_BUF_SIZE];
1181
1182                                         struct berval   cmp = op->o_conn->c_peer_domain;
1183                                         struct berval   pat = b->a_domain_pat;
1184
1185                                         if ( b->a_domain_expand ) {
1186                                                 struct berval bv;
1187
1188                                                 bv.bv_len = sizeof(buf) - 1;
1189                                                 bv.bv_val = buf;
1190
1191                                                 if ( string_expand(&bv, &b->a_domain_pat,
1192                                                                 e->e_ndn, nmatch, matches) )
1193                                                 {
1194                                                         continue;
1195                                                 }
1196                                                 pat = bv;
1197                                         }
1198
1199                                         if ( b->a_domain_style == ACL_STYLE_SUBTREE ) {
1200                                                 int offset = cmp.bv_len - pat.bv_len;
1201                                                 if ( offset < 0 ) {
1202                                                         continue;
1203                                                 }
1204
1205                                                 if ( offset == 1 || ( offset > 1 && cmp.bv_val[ offset - 1 ] != '.' ) ) {
1206                                                         continue;
1207                                                 }
1208
1209                                                 /* trim the domain */
1210                                                 cmp.bv_val = &cmp.bv_val[ offset ];
1211                                                 cmp.bv_len -= offset;
1212                                         }
1213
1214                                         if ( ber_bvstrcasecmp( &pat, &cmp ) != 0 ) {
1215                                                 continue;
1216                                         }
1217                                 }
1218                         }
1219                 }
1220
1221                 if ( !BER_BVISEMPTY( &b->a_peername_pat ) ) {
1222                         if ( !op->o_conn->c_peer_name.bv_val ) {
1223                                 continue;
1224                         }
1225                         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
1226                                 b->a_peername_pat.bv_val, 0, 0 );
1227                         if ( !ber_bvccmp( &b->a_peername_pat, '*' ) ) {
1228                                 if ( b->a_peername_style == ACL_STYLE_REGEX ) {
1229                                         if (!regex_matches( &b->a_peername_pat, op->o_conn->c_peer_name.bv_val,
1230                                                         e->e_ndn, nmatch, matches ) )
1231                                         {
1232                                                 continue;
1233                                         }
1234
1235                                 } else {
1236                                         /* try exact match */
1237                                         if ( b->a_peername_style == ACL_STYLE_BASE ) {
1238                                                 if ( ber_bvstrcasecmp( &b->a_peername_pat, &op->o_conn->c_peer_name ) != 0 ) {
1239                                                         continue;
1240                                                 }
1241
1242                                         } else if ( b->a_peername_style == ACL_STYLE_EXPAND ) {
1243                                                 struct berval   bv;
1244                                                 char buf[ACL_BUF_SIZE];
1245
1246                                                 bv.bv_len = sizeof( buf ) - 1;
1247                                                 bv.bv_val = buf;
1248                                                 if ( string_expand( &bv, &b->a_peername_pat,
1249                                                                 e->e_ndn, nmatch, matches ) )
1250                                                 {
1251                                                         continue;
1252                                                 }
1253
1254                                                 if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_peer_name ) != 0 ) {
1255                                                         continue;
1256                                                 }
1257
1258                                         /* extract IP and try exact match */
1259                                         } else if ( b->a_peername_style == ACL_STYLE_IP ) {
1260                                                 char            *port;
1261                                                 char            buf[] = "255.255.255.255";
1262                                                 struct berval   ip;
1263                                                 unsigned long   addr;
1264                                                 int             port_number = -1;
1265
1266                                                 if ( strncasecmp( op->o_conn->c_peer_name.bv_val,
1267                                                                         aci_bv_ip_eq.bv_val, aci_bv_ip_eq.bv_len ) != 0 )
1268                                                         continue;
1269
1270                                                 ip.bv_val = op->o_conn->c_peer_name.bv_val + aci_bv_ip_eq.bv_len;
1271                                                 ip.bv_len = op->o_conn->c_peer_name.bv_len - aci_bv_ip_eq.bv_len;
1272
1273                                                 port = strrchr( ip.bv_val, ':' );
1274                                                 if ( port ) {
1275                                                         char    *next;
1276
1277                                                         ip.bv_len = port - ip.bv_val;
1278                                                         ++port;
1279                                                         port_number = strtol( port, &next, 10 );
1280                                                         if ( next[0] != '\0' )
1281                                                                 continue;
1282                                                 }
1283
1284                                                 /* the port check can be anticipated here */
1285                                                 if ( b->a_peername_port != -1 && port_number != b->a_peername_port )
1286                                                         continue;
1287
1288                                                 /* address longer than expected? */
1289                                                 if ( ip.bv_len >= sizeof(buf) )
1290                                                         continue;
1291
1292                                                 AC_MEMCPY( buf, ip.bv_val, ip.bv_len );
1293                                                 buf[ ip.bv_len ] = '\0';
1294
1295                                                 addr = inet_addr( buf );
1296
1297                                                 /* unable to convert? */
1298                                                 if ( addr == (unsigned long)(-1) )
1299                                                         continue;
1300
1301                                                 if ( (addr & b->a_peername_mask) != b->a_peername_addr )
1302                                                         continue;
1303
1304 #ifdef LDAP_PF_LOCAL
1305                                         /* extract path and try exact match */
1306                                         } else if ( b->a_peername_style == ACL_STYLE_PATH ) {
1307                                                 struct berval path;
1308
1309                                                 if ( strncmp( op->o_conn->c_peer_name.bv_val,
1310                                                                         aci_bv_path_eq.bv_val, aci_bv_path_eq.bv_len ) != 0 )
1311                                                         continue;
1312
1313                                                 path.bv_val = op->o_conn->c_peer_name.bv_val + aci_bv_path_eq.bv_len;
1314                                                 path.bv_len = op->o_conn->c_peer_name.bv_len - aci_bv_path_eq.bv_len;
1315
1316                                                 if ( ber_bvcmp( &b->a_peername_pat, &path ) != 0 )
1317                                                         continue;
1318
1319 #endif /* LDAP_PF_LOCAL */
1320
1321                                         /* exact match (very unlikely...) */
1322                                         } else if ( ber_bvcmp( &op->o_conn->c_peer_name, &b->a_peername_pat ) != 0 ) {
1323                                                         continue;
1324                                         }
1325                                 }
1326                         }
1327                 }
1328
1329                 if ( !BER_BVISEMPTY( &b->a_sockname_pat ) ) {
1330                         if ( BER_BVISNULL( &op->o_conn->c_sock_name ) ) {
1331                                 continue;
1332                         }
1333                         Debug( LDAP_DEBUG_ACL, "<= check a_sockname_path: %s\n",
1334                                 b->a_sockname_pat.bv_val, 0, 0 );
1335                         if ( !ber_bvccmp( &b->a_sockname_pat, '*' ) ) {
1336                                 if ( b->a_sockname_style == ACL_STYLE_REGEX) {
1337                                         if (!regex_matches( &b->a_sockname_pat, op->o_conn->c_sock_name.bv_val,
1338                                                         e->e_ndn, nmatch, matches ) )
1339                                         {
1340                                                 continue;
1341                                         }
1342
1343                                 } else if ( b->a_sockname_style == ACL_STYLE_EXPAND ) {
1344                                         struct berval   bv;
1345                                         char buf[ACL_BUF_SIZE];
1346
1347                                         bv.bv_len = sizeof( buf ) - 1;
1348                                         bv.bv_val = buf;
1349                                         if ( string_expand( &bv, &b->a_sockname_pat,
1350                                                         e->e_ndn, nmatch, matches ) )
1351                                         {
1352                                                 continue;
1353                                         }
1354
1355                                         if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_sock_name ) != 0 ) {
1356                                                 continue;
1357                                         }
1358
1359                                 } else {
1360                                         if ( ber_bvstrcasecmp( &b->a_sockname_pat, &op->o_conn->c_sock_name ) != 0 ) {
1361                                                 continue;
1362                                         }
1363                                 }
1364                         }
1365                 }
1366
1367                 if ( b->a_dn_at != NULL ) {
1368                         if ( acl_mask_dnattr( op, e, val, a, b, i,
1369                                         matches, count, state,
1370                                         &b->a_dn, &op->o_ndn ) )
1371                         {
1372                                 continue;
1373                         }
1374                 }
1375
1376                 if ( b->a_realdn_at != NULL ) {
1377                         struct berval   ndn;
1378
1379                         if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) ) {
1380                                 ndn = op->o_conn->c_ndn;
1381                         } else {
1382                                 ndn = op->o_ndn;
1383                         }
1384
1385                         if ( acl_mask_dnattr( op, e, val, a, b, i,
1386                                         matches, count, state,
1387                                         &b->a_realdn, &ndn ) )
1388                         {
1389                                 continue;
1390                         }
1391                 }
1392
1393 #if 0
1394                 if ( b->a_dn_at != NULL ) {
1395                         Attribute       *at;
1396                         struct berval   bv;
1397                         int rc, match = 0;
1398                         const char *text;
1399                         const char *attr = b->a_dn_at->ad_cname.bv_val;
1400
1401                         assert( attr != NULL );
1402
1403                         if ( op->o_ndn.bv_len == 0 ) {
1404                                 continue;
1405                         }
1406
1407                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n",
1408                                 attr, 0, 0);
1409                         bv = op->o_ndn;
1410
1411                         /* see if asker is listed in dnattr */
1412                         for( at = attrs_find( e->e_attrs, b->a_dn_at );
1413                                 at != NULL;
1414                                 at = attrs_find( at->a_next, b->a_dn_at ) )
1415                         {
1416                                 if( value_find_ex( b->a_dn_at,
1417                                         SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
1418                                                 SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
1419                                         at->a_nvals,
1420                                         &bv, op->o_tmpmemctx ) == 0 )
1421                                 {
1422                                         /* found it */
1423                                         match = 1;
1424                                         break;
1425                                 }
1426                         }
1427
1428                         if ( match ) {
1429                                 /* have a dnattr match. if this is a self clause then
1430                                  * the target must also match the op dn.
1431                                  */
1432                                 if ( b->a_dn_self ) {
1433                                         /* check if the target is an attribute. */
1434                                         if ( val == NULL ) continue;
1435
1436                                         /* target is attribute, check if the attribute value
1437                                          * is the op dn.
1438                                          */
1439                                         rc = value_match( &match, b->a_dn_at,
1440                                                 b->a_dn_at->ad_type->sat_equality, 0,
1441                                                 val, &bv, &text );
1442                                         /* on match error or no match, fail the ACL clause */
1443                                         if (rc != LDAP_SUCCESS || match != 0 )
1444                                                 continue;
1445                                 }
1446
1447                         } else {
1448                                 /* no dnattr match, check if this is a self clause */
1449                                 if ( ! b->a_dn_self )
1450                                         continue;
1451
1452                                 ACL_RECORD_VALUE_STATE;
1453
1454                                 /* this is a self clause, check if the target is an
1455                                  * attribute.
1456                                  */
1457                                 if ( val == NULL )
1458                                         continue;
1459
1460                                 /* target is attribute, check if the attribute value
1461                                  * is the op dn.
1462                                  */
1463                                 rc = value_match( &match, b->a_dn_at,
1464                                         b->a_dn_at->ad_type->sat_equality, 0,
1465                                         val, &bv, &text );
1466
1467                                 /* on match error or no match, fail the ACL clause */
1468                                 if (rc != LDAP_SUCCESS || match != 0 )
1469                                         continue;
1470                         }
1471                 }
1472 #endif
1473
1474                 if ( !BER_BVISEMPTY( &b->a_group_pat ) ) {
1475                         struct berval bv;
1476                         struct berval ndn = BER_BVNULL;
1477                         int rc;
1478
1479                         if ( op->o_ndn.bv_len == 0 ) {
1480                                 continue;
1481                         }
1482
1483                         /* b->a_group is an unexpanded entry name, expanded it should be an
1484                          * entry with objectclass group* and we test to see if odn is one of
1485                          * the values in the attribute group
1486                          */
1487                         /* see if asker is listed in dnattr */
1488                         if ( b->a_group_style == ACL_STYLE_EXPAND ) {
1489                                 char            buf[ACL_BUF_SIZE];
1490                                 int             tmp_nmatch;
1491                                 regmatch_t      tmp_matches[2],
1492                                                 *tmp_matchesp = tmp_matches;
1493
1494                                 bv.bv_len = sizeof(buf) - 1;
1495                                 bv.bv_val = buf;
1496
1497                                 rc = 0;
1498
1499                                 switch ( a->acl_dn_style ) {
1500                                 case ACL_STYLE_REGEX:
1501                                         if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
1502                                                 tmp_matchesp = matches;
1503                                                 tmp_nmatch = nmatch;
1504                                                 break;
1505                                         }
1506
1507                                 /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
1508                                 case ACL_STYLE_BASE:
1509                                         tmp_matches[0].rm_so = 0;
1510                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1511                                         tmp_nmatch = 1;
1512                                         break;
1513
1514                                 case ACL_STYLE_ONE:
1515                                 case ACL_STYLE_SUBTREE:
1516                                 case ACL_STYLE_CHILDREN:
1517                                         tmp_matches[0].rm_so = 0;
1518                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1519                                         tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
1520                                         tmp_matches[1].rm_eo = e->e_nname.bv_len;
1521                                         tmp_nmatch = 2;
1522                                         break;
1523
1524                                 default:
1525                                         /* error */
1526                                         rc = 1;
1527                                         break;
1528                                 }
1529
1530                                 if ( rc ) {
1531                                         continue;
1532                                 }
1533
1534                                 if ( string_expand( &bv, &b->a_group_pat,
1535                                                 e->e_nname.bv_val,
1536                                                 tmp_nmatch, tmp_matchesp ) )
1537                                 {
1538                                         continue;
1539                                 }
1540
1541                                 if ( dnNormalize( 0, NULL, NULL, &bv, &ndn,
1542                                                 op->o_tmpmemctx ) != LDAP_SUCCESS )
1543                                 {
1544                                         /* did not expand to a valid dn */
1545                                         continue;
1546                                 }
1547
1548                                 bv = ndn;
1549
1550                         } else {
1551                                 bv = b->a_group_pat;
1552                         }
1553
1554                         rc = backend_group( op, e, &bv, &op->o_ndn,
1555                                 b->a_group_oc, b->a_group_at );
1556
1557                         if ( ndn.bv_val ) {
1558                                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
1559                         }
1560
1561                         if ( rc != 0 ) {
1562                                 continue;
1563                         }
1564                 }
1565
1566                 if ( !BER_BVISEMPTY( &b->a_set_pat ) ) {
1567                         struct berval   bv;
1568                         char            buf[ACL_BUF_SIZE];
1569
1570                         if ( b->a_set_style == ACL_STYLE_EXPAND ) {
1571                                 int             tmp_nmatch;
1572                                 regmatch_t      tmp_matches[2],
1573                                                 *tmp_matchesp = tmp_matches;
1574                                 int             rc = 0;
1575
1576                                 bv.bv_len = sizeof( buf ) - 1;
1577                                 bv.bv_val = buf;
1578
1579                                 rc = 0;
1580
1581                                 switch ( a->acl_dn_style ) {
1582                                 case ACL_STYLE_REGEX:
1583                                         if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
1584                                                 tmp_matchesp = matches;
1585                                                 tmp_nmatch = nmatch;
1586                                                 break;
1587                                         }
1588
1589                                 /* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
1590                                 case ACL_STYLE_BASE:
1591                                         tmp_matches[0].rm_so = 0;
1592                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1593                                         tmp_nmatch = 1;
1594                                         break;
1595
1596                                 case ACL_STYLE_ONE:
1597                                 case ACL_STYLE_SUBTREE:
1598                                 case ACL_STYLE_CHILDREN:
1599                                         tmp_matches[0].rm_so = 0;
1600                                         tmp_matches[0].rm_eo = e->e_nname.bv_len;
1601                                         tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
1602                                         tmp_matches[1].rm_eo = e->e_nname.bv_len;
1603                                         tmp_nmatch = 2;
1604                                         break;
1605
1606                                 default:
1607                                         /* error */
1608                                         rc = 1;
1609                                         break;
1610                                 }
1611
1612                                 if ( rc ) {
1613                                         continue;
1614                                 }
1615
1616                                 if ( string_expand( &bv, &b->a_set_pat,
1617                                                 e->e_nname.bv_val,
1618                                                 tmp_nmatch, tmp_matchesp ) )
1619                                 {
1620                                         continue;
1621                                 }
1622
1623                         } else {
1624                                 bv = b->a_set_pat;
1625                         }
1626
1627                         if ( aci_match_set( &bv, op, e, 0 ) == 0 ) {
1628                                 continue;
1629                         }
1630                 }
1631
1632                 if ( b->a_authz.sai_ssf ) {
1633                         Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
1634                                 b->a_authz.sai_ssf, op->o_ssf, 0 );
1635                         if ( b->a_authz.sai_ssf >  op->o_ssf ) {
1636                                 continue;
1637                         }
1638                 }
1639
1640                 if ( b->a_authz.sai_transport_ssf ) {
1641                         Debug( LDAP_DEBUG_ACL,
1642                                 "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
1643                                 b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
1644                         if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
1645                                 continue;
1646                         }
1647                 }
1648
1649                 if ( b->a_authz.sai_tls_ssf ) {
1650                         Debug( LDAP_DEBUG_ACL,
1651                                 "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
1652                                 b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
1653                         if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
1654                                 continue;
1655                         }
1656                 }
1657
1658                 if ( b->a_authz.sai_sasl_ssf ) {
1659                         Debug( LDAP_DEBUG_ACL,
1660                                 "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
1661                                 b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
1662                         if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
1663                                 continue;
1664                         }
1665                 }
1666
1667 #ifdef SLAP_DYNACL
1668                 if ( b->a_dynacl ) {
1669                         slap_dynacl_t   *da;
1670                         slap_access_t   tgrant, tdeny;
1671
1672                         /* this case works different from the others above.
1673                          * since aci's themselves give permissions, we need
1674                          * to first check b->a_access_mask, the ACL's access level.
1675                          */
1676                         if ( BER_BVISEMPTY( &e->e_nname ) ) {
1677                                 /* no ACIs in the root DSE */
1678                                 continue;
1679                         }
1680
1681                         /* first check if the right being requested
1682                          * is allowed by the ACL clause.
1683                          */
1684                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
1685                                 continue;
1686                         }
1687
1688                         /* start out with nothing granted, nothing denied */
1689                         ACL_INIT(tgrant);
1690                         ACL_INIT(tdeny);
1691
1692                         for ( da = b->a_dynacl; da; da = da->da_next ) {
1693                                 slap_access_t   grant, deny;
1694
1695                                 (void)( *da->da_mask )( da->da_private, op, e, desc, val, nmatch, matches, &grant, &deny );
1696
1697                                 tgrant |= grant;
1698                                 tdeny |= deny;
1699                         }
1700
1701                         /* remove anything that the ACL clause does not allow */
1702                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
1703                         tdeny &= ACL_PRIV_MASK;
1704
1705                         /* see if we have anything to contribute */
1706                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
1707                                 continue;
1708                         }
1709
1710                         /* this could be improved by changing acl_mask so that it can deal with
1711                          * by clauses that return grant/deny pairs.  Right now, it does either
1712                          * additive or subtractive rights, but not both at the same time.  So,
1713                          * we need to combine the grant/deny pair into a single rights mask in
1714                          * a smart way:  if either grant or deny is "empty", then we use the
1715                          * opposite as is, otherwise we remove any denied rights from the grant
1716                          * rights mask and construct an additive mask.
1717                          */
1718                         if (ACL_IS_INVALID(tdeny)) {
1719                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
1720
1721                         } else if (ACL_IS_INVALID(tgrant)) {
1722                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
1723
1724                         } else {
1725                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
1726                         }
1727
1728                 } else
1729 #else /* !SLAP_DYNACL */
1730
1731 #ifdef SLAPD_ACI_ENABLED
1732                 if ( b->a_aci_at != NULL ) {
1733                         Attribute       *at;
1734                         slap_access_t   grant, deny, tgrant, tdeny;
1735                         struct berval   parent_ndn;
1736                         BerVarray       bvals = NULL;
1737                         int             ret, stop;
1738
1739                         /* this case works different from the others above.
1740                          * since aci's themselves give permissions, we need
1741                          * to first check b->a_access_mask, the ACL's access level.
1742                          */
1743
1744                         if ( BER_BVISEMPTY( &e->e_nname ) ) {
1745                                 /* no ACIs in the root DSE */
1746                                 continue;
1747                         }
1748
1749                         /* first check if the right being requested
1750                          * is allowed by the ACL clause.
1751                          */
1752                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
1753                                 continue;
1754                         }
1755                         /* start out with nothing granted, nothing denied */
1756                         ACL_INIT(tgrant);
1757                         ACL_INIT(tdeny);
1758
1759                         /* get the aci attribute */
1760                         at = attr_find( e->e_attrs, b->a_aci_at );
1761                         if ( at != NULL ) {
1762 #if 0
1763                                 /* FIXME: this breaks acl caching;
1764                                  * see also ACL_RECORD_VALUE_STATE below */
1765                                 ACL_RECORD_VALUE_STATE;
1766 #endif
1767                                 /* the aci is an multi-valued attribute.  The
1768                                 * rights are determined by OR'ing the individual
1769                                 * rights given by the acis.
1770                                 */
1771                                 for ( i = 0; !BER_BVISNULL( &at->a_nvals[i] ); i++ ) {
1772                                         if (aci_mask( op,
1773                                                 e, desc, val,
1774                                                 &at->a_nvals[i],
1775                                                 nmatch, matches,
1776                                                 &grant, &deny, SLAP_ACI_SCOPE_ENTRY ) != 0)
1777                                         {
1778                                                 tgrant |= grant;
1779                                                 tdeny |= deny;
1780                                         }
1781                                 }
1782                                 Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
1783                                           accessmask2str(tgrant, accessmaskbuf, 1),
1784                                           accessmask2str(tdeny, accessmaskbuf1, 1), 0);
1785
1786                         }
1787                         /* If the entry level aci didn't contain anything valid for the
1788                          * current operation, climb up the tree and evaluate the
1789                          * acis with scope set to subtree
1790                          */
1791                         if ( (tgrant == ACL_PRIV_NONE) && (tdeny == ACL_PRIV_NONE) ) {
1792                                 dnParent( &e->e_nname, &parent_ndn );
1793                                 while ( !BER_BVISEMPTY( &parent_ndn ) ) {
1794                                         Debug(LDAP_DEBUG_ACL, "checking ACI of %s\n", parent_ndn.bv_val, 0, 0);
1795                                         ret = backend_attribute(op, NULL, &parent_ndn, b->a_aci_at, &bvals, ACL_AUTH);
1796                                         switch(ret){
1797                                         case LDAP_SUCCESS :
1798                                                 stop = 0;
1799                                                 if (!bvals){
1800                                                         break;
1801                                                 }
1802
1803                                                 for( i = 0; bvals[i].bv_val != NULL; i++){
1804 #if 0
1805                                                         /* FIXME: this breaks acl caching;
1806                                                          * see also ACL_RECORD_VALUE_STATE above */
1807                                                         ACL_RECORD_VALUE_STATE;
1808 #endif
1809                                                         if (aci_mask(op, e, desc, val, &bvals[i],
1810                                                                         nmatch, matches,
1811                                                                         &grant, &deny, SLAP_ACI_SCOPE_CHILDREN ) != 0 )
1812                                                         {
1813                                                                 tgrant |= grant;
1814                                                                 tdeny |= deny;
1815                                                                 /* evaluation stops as soon as either a "deny" or a
1816                                                                  * "grant" directive matches.
1817                                                                  */
1818                                                                 if( (tgrant != ACL_PRIV_NONE) || (tdeny != ACL_PRIV_NONE) ){
1819                                                                         stop = 1;
1820                                                                 }
1821                                                         }
1822                                                         Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
1823                                                                 accessmask2str(tgrant, accessmaskbuf, 1),
1824                                                                 accessmask2str(tdeny, accessmaskbuf1, 1), 0);
1825                                                 }
1826                                                 break;
1827
1828                                         case LDAP_NO_SUCH_ATTRIBUTE:
1829                                                 /* just go on if the aci-Attribute is not present in
1830                                                  * the current entry
1831                                                  */
1832                                                 Debug(LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0);
1833                                                 stop = 0;
1834                                                 break;
1835
1836                                         case LDAP_NO_SUCH_OBJECT:
1837                                                 /* We have reached the base object */
1838                                                 Debug(LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0);
1839                                                 stop = 1;
1840                                                 break;
1841
1842                                         default:
1843                                                 stop = 1;
1844                                                 break;
1845                                         }
1846                                         if (stop){
1847                                                 break;
1848                                         }
1849                                         dnParent( &parent_ndn, &parent_ndn );
1850                                 }
1851                         }
1852
1853
1854                         /* remove anything that the ACL clause does not allow */
1855                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
1856                         tdeny &= ACL_PRIV_MASK;
1857
1858                         /* see if we have anything to contribute */
1859                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
1860                                 continue;
1861                         }
1862
1863                         /* this could be improved by changing acl_mask so that it can deal with
1864                          * by clauses that return grant/deny pairs.  Right now, it does either
1865                          * additive or subtractive rights, but not both at the same time.  So,
1866                          * we need to combine the grant/deny pair into a single rights mask in
1867                          * a smart way:  if either grant or deny is "empty", then we use the
1868                          * opposite as is, otherwise we remove any denied rights from the grant
1869                          * rights mask and construct an additive mask.
1870                          */
1871                         if (ACL_IS_INVALID(tdeny)) {
1872                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
1873
1874                         } else if (ACL_IS_INVALID(tgrant)) {
1875                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
1876
1877                         } else {
1878                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
1879                         }
1880
1881                 } else
1882 #endif /* SLAPD_ACI_ENABLED */
1883 #endif /* !SLAP_DYNACL */
1884                 {
1885                         modmask = b->a_access_mask;
1886                 }
1887
1888                 Debug( LDAP_DEBUG_ACL,
1889                         "<= acl_mask: [%d] applying %s (%s)\n",
1890                         i, accessmask2str( modmask, accessmaskbuf, 1 ),
1891                         b->a_type == ACL_CONTINUE
1892                                 ? "continue"
1893                                 : b->a_type == ACL_BREAK
1894                                         ? "break"
1895                                         : "stop" );
1896                 /* save old mask */
1897                 oldmask = *mask;
1898
1899                 if( ACL_IS_ADDITIVE(modmask) ) {
1900                         /* add privs */
1901                         ACL_PRIV_SET( *mask, modmask );
1902
1903                         /* cleanup */
1904                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
1905
1906                 } else if( ACL_IS_SUBTRACTIVE(modmask) ) {
1907                         /* substract privs */
1908                         ACL_PRIV_CLR( *mask, modmask );
1909
1910                         /* cleanup */
1911                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
1912
1913                 } else {
1914                         /* assign privs */
1915                         *mask = modmask;
1916                 }
1917
1918                 Debug( LDAP_DEBUG_ACL,
1919                         "<= acl_mask: [%d] mask: %s\n",
1920                         i, accessmask2str(*mask, accessmaskbuf, 1), 0 );
1921
1922                 if( b->a_type == ACL_CONTINUE ) {
1923                         continue;
1924
1925                 } else if ( b->a_type == ACL_BREAK ) {
1926                         return ACL_BREAK;
1927
1928                 } else {
1929                         return ACL_STOP;
1930                 }
1931         }
1932
1933         /* implicit "by * none" clause */
1934         ACL_INIT(*mask);
1935
1936         Debug( LDAP_DEBUG_ACL,
1937                 "<= acl_mask: no more <who> clauses, returning %s (stop)\n",
1938                 accessmask2str(*mask, accessmaskbuf, 1), 0, 0 );
1939         return ACL_STOP;
1940 }
1941
1942 /*
1943  * acl_check_modlist - check access control on the given entry to see if
1944  * it allows the given modifications by the user associated with op.
1945  * returns      1       if mods allowed ok
1946  *              0       mods not allowed
1947  */
1948
1949 int
1950 acl_check_modlist(
1951         Operation       *op,
1952         Entry   *e,
1953         Modifications   *mlist
1954 )
1955 {
1956         struct berval *bv;
1957         AccessControlState state = ACL_STATE_INIT;
1958         Backend *be;
1959         int be_null = 0;
1960         int ret = 1; /* default is access allowed */
1961
1962         be = op->o_bd;
1963         if ( be == NULL ) {
1964                 be = LDAP_STAILQ_FIRST(&backendDB);
1965                 be_null = 1;
1966                 op->o_bd = be;
1967         }
1968         assert( be != NULL );
1969
1970         /* short circuit root database access */
1971         if ( be_isroot( op ) ) {
1972                 Debug( LDAP_DEBUG_ACL,
1973                         "<= acl_access_allowed: granted to database root\n",
1974                     0, 0, 0 );
1975                 goto done;
1976         }
1977
1978         /* use backend default access if no backend acls */
1979         if( op->o_bd != NULL && op->o_bd->be_acl == NULL ) {
1980                 Debug( LDAP_DEBUG_ACL,
1981                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
1982                         access2str( ACL_WRITE ),
1983                         op->o_bd->be_dfltaccess >= ACL_WRITE
1984                                 ? "granted" : "denied",
1985                         op->o_dn.bv_val );
1986                 ret = (op->o_bd->be_dfltaccess >= ACL_WRITE);
1987                 goto done;
1988         }
1989
1990         for ( ; mlist != NULL; mlist = mlist->sml_next ) {
1991                 /*
1992                  * no-user-modification operational attributes are ignored
1993                  * by ACL_WRITE checking as any found here are not provided
1994                  * by the user
1995                  */
1996                 if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
1997                         Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
1998                                 " modify access granted\n",
1999                                 mlist->sml_desc->ad_cname.bv_val, 0, 0 );
2000                         continue;
2001                 }
2002
2003                 switch ( mlist->sml_op ) {
2004                 case LDAP_MOD_REPLACE:
2005                         /*
2006                          * We must check both permission to delete the whole
2007                          * attribute and permission to add the specific attributes.
2008                          * This prevents abuse from selfwriters.
2009                          */
2010                         if ( ! access_allowed( op, e,
2011                                 mlist->sml_desc, NULL, ACL_WRITE, &state ) )
2012                         {
2013                                 ret = 0;
2014                                 goto done;
2015                         }
2016
2017                         if ( mlist->sml_values == NULL ) break;
2018
2019                         /* fall thru to check value to add */
2020
2021                 case LDAP_MOD_ADD:
2022                         assert( mlist->sml_values != NULL );
2023
2024                         for ( bv = mlist->sml_nvalues
2025                                         ? mlist->sml_nvalues : mlist->sml_values;
2026                                 bv->bv_val != NULL; bv++ )
2027                         {
2028                                 if ( ! access_allowed( op, e,
2029                                         mlist->sml_desc, bv, ACL_WRITE, &state ) )
2030                                 {
2031                                         ret = 0;
2032                                         goto done;
2033                                 }
2034                         }
2035                         break;
2036
2037                 case LDAP_MOD_DELETE:
2038                         if ( mlist->sml_values == NULL ) {
2039                                 if ( ! access_allowed( op, e,
2040                                         mlist->sml_desc, NULL, ACL_WRITE, NULL ) )
2041                                 {
2042                                         ret = 0;
2043                                         goto done;
2044                                 }
2045                                 break;
2046                         }
2047                         for ( bv = mlist->sml_nvalues
2048                                         ? mlist->sml_nvalues : mlist->sml_values;
2049                                 bv->bv_val != NULL; bv++ )
2050                         {
2051                                 if ( ! access_allowed( op, e,
2052                                         mlist->sml_desc, bv, ACL_WRITE, &state ) )
2053                                 {
2054                                         ret = 0;
2055                                         goto done;
2056                                 }
2057                         }
2058                         break;
2059
2060                 case SLAP_MOD_SOFTADD:
2061                         /* allow adding attribute via modrdn thru */
2062                         break;
2063
2064                 default:
2065                         assert( 0 );
2066                         /* not reached */
2067                         ret = 0;
2068                         break;
2069                 }
2070         }
2071
2072 done:
2073         if (be_null) op->o_bd = NULL;
2074         return( ret );
2075 }
2076
2077 static int
2078 aci_get_part(
2079         struct berval   *list,
2080         int             ix,
2081         char            sep,
2082         struct berval   *bv )
2083 {
2084         int     len;
2085         char    *p;
2086
2087         if ( bv ) {
2088                 BER_BVZERO( bv );
2089         }
2090         len = list->bv_len;
2091         p = list->bv_val;
2092         while ( len >= 0 && --ix >= 0 ) {
2093                 while ( --len >= 0 && *p++ != sep )
2094                         ;
2095         }
2096         while ( len >= 0 && *p == ' ' ) {
2097                 len--;
2098                 p++;
2099         }
2100         if ( len < 0 ) {
2101                 return -1;
2102         }
2103
2104         if ( !bv ) {
2105                 return 0;
2106         }
2107
2108         bv->bv_val = p;
2109         while ( --len >= 0 && *p != sep ) {
2110                 bv->bv_len++;
2111                 p++;
2112         }
2113         while ( bv->bv_len > 0 && *--p == ' ' ) {
2114                 bv->bv_len--;
2115         }
2116
2117         return bv->bv_len;
2118 }
2119
2120 typedef struct aci_set_gather_t {
2121         SetCookie               *cookie;
2122         BerVarray               bvals;
2123 } aci_set_gather_t;
2124
2125 static int
2126 aci_set_cb_gather( Operation *op, SlapReply *rs )
2127 {
2128         aci_set_gather_t        *p = (aci_set_gather_t *)op->o_callback->sc_private;
2129
2130         if ( rs->sr_type == REP_SEARCH ) {
2131                 BerValue        bvals[ 2 ];
2132                 BerVarray       bvalsp = NULL;
2133                 int             j;
2134
2135                 for ( j = 0; !BER_BVISNULL( &rs->sr_attrs[ j ].an_name ); j++ ) {
2136                         AttributeDescription    *desc = rs->sr_attrs[ j ].an_desc;
2137
2138                         if ( desc == slap_schema.si_ad_entryDN ) {
2139                                 bvalsp = bvals;
2140                                 bvals[ 0 ] = rs->sr_entry->e_nname;
2141                                 BER_BVZERO( &bvals[ 1 ] );
2142
2143                         } else {
2144                                 Attribute       *a;
2145
2146                                 a = attr_find( rs->sr_entry->e_attrs, desc );
2147                                 if ( a != NULL ) {
2148                                         int     i;
2149
2150                                         for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ )
2151                                                 ;
2152
2153                                         bvalsp = a->a_nvals;
2154                                 }
2155                         }
2156                 }
2157
2158                 if ( bvals ) {
2159                         p->bvals = slap_set_join( p->cookie, p->bvals,
2160                                         ( '|' | SLAP_SET_RREF ), bvalsp );
2161                 }
2162
2163         } else {
2164                 assert( rs->sr_type == REP_RESULT );
2165         }
2166
2167         return 0;
2168 }
2169
2170 BerVarray
2171 aci_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *desc )
2172 {
2173         AciSetCookie            *cp = (AciSetCookie *)cookie;
2174         int                     rc = 0;
2175         LDAPURLDesc             *ludp = NULL;
2176         Operation               op2 = { 0 };
2177         SlapReply               rs = {REP_RESULT};
2178         AttributeName           anlist[ 2 ], *anlistp = NULL;
2179         int                     nattrs = 0;
2180         slap_callback           cb = { NULL, aci_set_cb_gather, NULL, NULL };
2181         aci_set_gather_t        p = { 0 };
2182         const char              *text = NULL;
2183         static struct berval    defaultFilter_bv = BER_BVC( "(objectClass=*)" );
2184
2185         /* this routine needs to return the bervals instead of
2186          * plain strings, since syntax is not known.  It should
2187          * also return the syntax or some "comparison cookie".
2188          */
2189         if ( strncasecmp( name->bv_val, "ldap:///", STRLENOF( "ldap:///" ) ) != 0 ) {
2190                 return aci_set_gather2( cookie, name, desc );
2191         }
2192
2193         rc = ldap_url_parse( name->bv_val, &ludp );
2194         if ( rc != LDAP_URL_SUCCESS ) {
2195                 rc = LDAP_PROTOCOL_ERROR;
2196                 goto url_done;
2197         }
2198
2199         if ( ( ludp->lud_host && ludp->lud_host[0] ) || ludp->lud_exts )
2200         {
2201                 /* host part must be empty */
2202                 /* extensions parts must be empty */
2203                 rc = LDAP_PROTOCOL_ERROR;
2204                 goto url_done;
2205         }
2206
2207         /* Grab the searchbase and see if an appropriate database can be found */
2208         ber_str2bv( ludp->lud_dn, 0, 0, &op2.o_req_dn );
2209         rc = dnNormalize( 0, NULL, NULL, &op2.o_req_dn,
2210                         &op2.o_req_ndn, cp->op->o_tmpmemctx );
2211         BER_BVZERO( &op2.o_req_dn );
2212         if ( rc != LDAP_SUCCESS ) {
2213                 goto url_done;
2214         }
2215
2216         op2.o_bd = select_backend( &op2.o_req_ndn, 0, 1 );
2217         if ( ( op2.o_bd == NULL ) || ( op2.o_bd->be_search == NULL ) ) {
2218                 rc = LDAP_NO_SUCH_OBJECT;
2219                 goto url_done;
2220         }
2221
2222         /* Grab the filter */
2223         if ( ludp->lud_filter ) {
2224                 ber_str2bv_x( ludp->lud_filter, 0, 0, &op2.ors_filterstr,
2225                                 cp->op->o_tmpmemctx );
2226
2227         } else {
2228                 op2.ors_filterstr = defaultFilter_bv;
2229         }
2230
2231         op2.ors_filter = str2filter_x( cp->op, op2.ors_filterstr.bv_val );
2232         if ( op2.ors_filter == NULL ) {
2233                 rc = LDAP_PROTOCOL_ERROR;
2234                 goto url_done;
2235         }
2236
2237         /* Grab the scope */
2238         op2.ors_scope = ludp->lud_scope;
2239
2240         /* Grap the attributes */
2241         if ( ludp->lud_attrs ) {
2242                 for ( ; ludp->lud_attrs[ nattrs ]; nattrs++ )
2243                         ;
2244
2245                 anlistp = slap_sl_malloc( sizeof( AttributeName ) * ( nattrs + 2 ),
2246                                 cp->op->o_tmpmemctx );
2247
2248                 for ( ; ludp->lud_attrs[ nattrs ]; nattrs++ ) {
2249                         ber_str2bv( ludp->lud_attrs[ nattrs ], 0, 0, &anlistp[ nattrs ].an_name );
2250                         anlistp[ nattrs ].an_desc = NULL;
2251                         rc = slap_bv2ad( &anlistp[ nattrs ].an_name,
2252                                         &anlistp[ nattrs ].an_desc, &text );
2253                         if ( rc != LDAP_SUCCESS ) {
2254                                 goto url_done;
2255                         }
2256                 }
2257
2258         } else {
2259                 anlistp = anlist;
2260         }
2261
2262         anlistp[ nattrs ].an_name = desc->ad_cname;
2263         anlistp[ nattrs ].an_desc = desc;
2264
2265         BER_BVZERO( &anlistp[ nattrs + 1 ].an_name );
2266
2267         p.cookie = cookie;
2268
2269         op2.o_hdr = cp->op->o_hdr;
2270         op2.o_tag = LDAP_REQ_SEARCH;
2271         op2.o_ndn = op2.o_bd->be_rootndn;
2272         op2.o_callback = &cb;
2273         op2.o_time = slap_get_time();
2274         op2.o_do_not_cache = 1;
2275         op2.o_is_auth_check = 0;
2276         ber_dupbv_x( &op2.o_req_dn, &op2.o_req_ndn, cp->op->o_tmpmemctx );
2277         op2.ors_slimit = SLAP_NO_LIMIT;
2278         op2.ors_tlimit = SLAP_NO_LIMIT;
2279         op2.ors_attrs = anlistp;
2280         op2.ors_attrsonly = 0;
2281         op2.o_private = cp->op->o_private;
2282
2283         cb.sc_private = &p;
2284
2285         rc = op2.o_bd->be_search( &op2, &rs );
2286         if ( rc != 0 ) {
2287                 goto url_done;
2288         }
2289
2290 url_done:;
2291         if ( op2.ors_filter ) {
2292                 filter_free_x( cp->op, op2.ors_filter );
2293         }
2294         if ( !BER_BVISNULL( &op2.o_req_ndn ) ) {
2295                 slap_sl_free( op2.o_req_ndn.bv_val, cp->op->o_tmpmemctx );
2296         }
2297         if ( !BER_BVISNULL( &op2.o_req_dn ) ) {
2298                 slap_sl_free( op2.o_req_dn.bv_val, cp->op->o_tmpmemctx );
2299         }
2300         if ( ludp ) {
2301                 ldap_free_urldesc( ludp );
2302         }
2303         if ( anlistp && anlistp != anlist ) {
2304                 slap_sl_free( anlistp, cp->op->o_tmpmemctx );
2305         }
2306
2307         return p.bvals;
2308 }
2309
2310 BerVarray
2311 aci_set_gather2( SetCookie *cookie, struct berval *name, AttributeDescription *desc )
2312 {
2313         AciSetCookie    *cp = (AciSetCookie *)cookie;
2314         BerVarray       bvals = NULL;
2315         struct berval   ndn;
2316         int             rc = 0;
2317
2318         /* this routine needs to return the bervals instead of
2319          * plain strings, since syntax is not known.  It should
2320          * also return the syntax or some "comparison cookie".
2321          */
2322         rc = dnNormalize( 0, NULL, NULL, name, &ndn, cp->op->o_tmpmemctx );
2323         if ( rc == LDAP_SUCCESS ) {
2324                 if ( desc == slap_schema.si_ad_entryDN ) {
2325                         bvals = (BerVarray)slap_sl_malloc( sizeof( BerValue ) * 2,
2326                                         cp->op->o_tmpmemctx );
2327                         bvals[ 0 ] = ndn;
2328                         BER_BVZERO( &bvals[ 1 ] );
2329                         BER_BVZERO( &ndn );
2330
2331                 } else {
2332                         backend_attribute( cp->op,
2333                                 cp->e, &ndn, desc, &bvals, ACL_NONE );
2334                 }
2335
2336                 if ( !BER_BVISNULL( &ndn ) ) {
2337                         slap_sl_free( ndn.bv_val, cp->op->o_tmpmemctx );
2338                 }
2339         }
2340
2341         return bvals;
2342 }
2343
2344 static int
2345 aci_match_set (
2346         struct berval *subj,
2347         Operation *op,
2348         Entry *e,
2349         int setref
2350 )
2351 {
2352         struct berval   set = BER_BVNULL;
2353         int             rc = 0;
2354         AciSetCookie    cookie;
2355
2356         if ( setref == 0 ) {
2357                 ber_dupbv_x( &set, subj, op->o_tmpmemctx );
2358
2359         } else {
2360                 struct berval           subjdn, ndn = BER_BVNULL;
2361                 struct berval           setat;
2362                 BerVarray               bvals;
2363                 const char              *text;
2364                 AttributeDescription    *desc = NULL;
2365
2366                 /* format of string is "entry/setAttrName" */
2367                 if ( aci_get_part( subj, 0, '/', &subjdn ) < 0 ) {
2368                         return 0;
2369                 }
2370
2371                 if ( aci_get_part( subj, 1, '/', &setat ) < 0 ) {
2372                         setat = aci_bv_set_attr;
2373                 }
2374
2375                 /*
2376                  * NOTE: dnNormalize honors the ber_len field
2377                  * as the length of the dn to be normalized
2378                  */
2379                 if ( slap_bv2ad( &setat, &desc, &text ) == LDAP_SUCCESS ) {
2380                         if ( dnNormalize( 0, NULL, NULL, &subjdn, &ndn, op->o_tmpmemctx ) == LDAP_SUCCESS )
2381                         {
2382                                 backend_attribute( op, e, &ndn, desc, &bvals, ACL_NONE );
2383                                 if ( bvals != NULL && !BER_BVISNULL( &bvals[0] ) ) {
2384                                         int     i;
2385
2386                                         set = bvals[0];
2387                                         BER_BVZERO( &bvals[0] );
2388                                         for ( i = 1; !BER_BVISNULL( &bvals[i] ); i++ )
2389                                                 /* count */ ;
2390                                         bvals[0].bv_val = bvals[i-1].bv_val;
2391                                         BER_BVZERO( &bvals[i-1] );
2392                                 }
2393                                 ber_bvarray_free_x( bvals, op->o_tmpmemctx );
2394                                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2395                         }
2396                 }
2397         }
2398
2399         if ( !BER_BVISNULL( &set ) ) {
2400                 cookie.op = op;
2401                 cookie.e = e;
2402                 rc = ( slap_set_filter( aci_set_gather, (SetCookie *)&cookie, &set,
2403                         &op->o_ndn, &e->e_nname, NULL ) > 0 );
2404                 slap_sl_free( set.bv_val, op->o_tmpmemctx );
2405         }
2406
2407         return(rc);
2408 }
2409
2410 #ifdef SLAPD_ACI_ENABLED
2411 static int
2412 aci_list_map_rights(
2413         struct berval *list )
2414 {
2415         struct berval bv;
2416         slap_access_t mask;
2417         int i;
2418
2419         ACL_INIT(mask);
2420         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
2421                 if (bv.bv_len <= 0)
2422                         continue;
2423                 switch (*bv.bv_val) {
2424                 case 'c':
2425                         ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
2426                         break;
2427                 case 's':
2428                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
2429                          * the right 's' to mean "set", but in the examples states
2430                          * that the right 's' means "search".  The latter definition
2431                          * is used here.
2432                          */
2433                         ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
2434                         break;
2435                 case 'r':
2436                         ACL_PRIV_SET(mask, ACL_PRIV_READ);
2437                         break;
2438                 case 'w':
2439                         ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
2440                         break;
2441                 case 'x':
2442                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
2443                          * define any equivalent to the AUTH right, so I've just used
2444                          * 'x' for now.
2445                          */
2446                         ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
2447                         break;
2448                 default:
2449                         break;
2450                 }
2451
2452         }
2453         return(mask);
2454 }
2455
2456 static int
2457 aci_list_has_attr(
2458         struct berval *list,
2459         const struct berval *attr,
2460         struct berval *val )
2461 {
2462         struct berval bv, left, right;
2463         int i;
2464
2465         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
2466                 if (aci_get_part(&bv, 0, '=', &left) < 0
2467                         || aci_get_part(&bv, 1, '=', &right) < 0)
2468                 {
2469                         if (ber_bvstrcasecmp(attr, &bv) == 0)
2470                                 return(1);
2471                 } else if (val == NULL) {
2472                         if (ber_bvstrcasecmp(attr, &left) == 0)
2473                                 return(1);
2474                 } else {
2475                         if (ber_bvstrcasecmp(attr, &left) == 0) {
2476                                 /* this is experimental code that implements a
2477                                  * simple (prefix) match of the attribute value.
2478                                  * the ACI draft does not provide for aci's that
2479                                  * apply to specific values, but it would be
2480                                  * nice to have.  If the <attr> part of an aci's
2481                                  * rights list is of the form <attr>=<value>,
2482                                  * that means the aci applies only to attrs with
2483                                  * the given value.  Furthermore, if the attr is
2484                                  * of the form <attr>=<value>*, then <value> is
2485                                  * treated as a prefix, and the aci applies to
2486                                  * any value with that prefix.
2487                                  *
2488                                  * Ideally, this would allow r.e. matches.
2489                                  */
2490                                 if (aci_get_part(&right, 0, '*', &left) < 0
2491                                         || right.bv_len <= left.bv_len)
2492                                 {
2493                                         if (ber_bvstrcasecmp(val, &right) == 0)
2494                                                 return(1);
2495                                 } else if (val->bv_len >= left.bv_len) {
2496                                         if (strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0)
2497                                                 return(1);
2498                                 }
2499                         }
2500                 }
2501         }
2502         return(0);
2503 }
2504
2505 static slap_access_t
2506 aci_list_get_attr_rights(
2507         struct berval *list,
2508         const struct berval *attr,
2509         struct berval *val )
2510 {
2511     struct berval bv;
2512     slap_access_t mask;
2513     int i;
2514
2515         /* loop through each rights/attr pair, skip first part (action) */
2516         ACL_INIT(mask);
2517         for (i = 1; aci_get_part(list, i + 1, ';', &bv) >= 0; i += 2) {
2518                 if (aci_list_has_attr(&bv, attr, val) == 0)
2519                         continue;
2520                 if (aci_get_part(list, i, ';', &bv) < 0)
2521                         continue;
2522                 mask |= aci_list_map_rights(&bv);
2523         }
2524         return(mask);
2525 }
2526
2527 static int
2528 aci_list_get_rights(
2529         struct berval *list,
2530         const struct berval *attr,
2531         struct berval *val,
2532         slap_access_t *grant,
2533         slap_access_t *deny )
2534 {
2535     struct berval perm, actn;
2536     slap_access_t *mask;
2537     int i, found;
2538
2539         if (attr == NULL || attr->bv_len == 0
2540                         || ber_bvstrcasecmp( attr, &aci_bv_entry ) == 0) {
2541                 attr = &aci_bv_br_entry;
2542         }
2543
2544         found = 0;
2545         ACL_INIT(*grant);
2546         ACL_INIT(*deny);
2547         /* loop through each permissions clause */
2548         for (i = 0; aci_get_part(list, i, '$', &perm) >= 0; i++) {
2549                 if (aci_get_part(&perm, 0, ';', &actn) < 0)
2550                         continue;
2551                 if (ber_bvstrcasecmp( &aci_bv_grant, &actn ) == 0) {
2552                         mask = grant;
2553                 } else if (ber_bvstrcasecmp( &aci_bv_deny, &actn ) == 0) {
2554                         mask = deny;
2555                 } else {
2556                         continue;
2557                 }
2558
2559                 found = 1;
2560                 *mask |= aci_list_get_attr_rights(&perm, attr, val);
2561                 *mask |= aci_list_get_attr_rights(&perm, &aci_bv_br_all, NULL);
2562         }
2563         return(found);
2564 }
2565
2566 static int
2567 aci_group_member (
2568         struct berval   *subj,
2569         struct berval   *defgrpoc,
2570         struct berval   *defgrpat,
2571         Operation       *op,
2572         Entry           *e,
2573         int             nmatch,
2574         regmatch_t      *matches
2575 )
2576 {
2577         struct berval subjdn;
2578         struct berval grpoc;
2579         struct berval grpat;
2580         ObjectClass *grp_oc = NULL;
2581         AttributeDescription *grp_ad = NULL;
2582         const char *text;
2583         int rc;
2584
2585         /* format of string is "group/objectClassValue/groupAttrName" */
2586         if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
2587                 return(0);
2588         }
2589
2590         if (aci_get_part(subj, 1, '/', &grpoc) < 0) {
2591                 grpoc = *defgrpoc;
2592         }
2593
2594         if (aci_get_part(subj, 2, '/', &grpat) < 0) {
2595                 grpat = *defgrpat;
2596         }
2597
2598         rc = slap_bv2ad( &grpat, &grp_ad, &text );
2599         if( rc != LDAP_SUCCESS ) {
2600                 rc = 0;
2601                 goto done;
2602         }
2603         rc = 0;
2604
2605         grp_oc = oc_bvfind( &grpoc );
2606
2607         if (grp_oc != NULL && grp_ad != NULL ) {
2608                 char buf[ACL_BUF_SIZE];
2609                 struct berval bv, ndn;
2610                 bv.bv_len = sizeof( buf ) - 1;
2611                 bv.bv_val = (char *)&buf;
2612                 if ( string_expand(&bv, &subjdn,
2613                                 e->e_ndn, nmatch, matches) )
2614                 {
2615                         rc = LDAP_OTHER;
2616                         goto done;
2617                 }
2618                 if ( dnNormalize( 0, NULL, NULL, &bv, &ndn, op->o_tmpmemctx ) == LDAP_SUCCESS ) {
2619                         rc = ( backend_group( op, e, &ndn, &op->o_ndn,
2620                                 grp_oc, grp_ad ) == 0 );
2621                         slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2622                 }
2623         }
2624
2625 done:
2626         return(rc);
2627 }
2628
2629 static int
2630 aci_mask(
2631         Operation               *op,
2632         Entry                   *e,
2633         AttributeDescription    *desc,
2634         struct berval           *val,
2635         struct berval           *aci,
2636         int                     nmatch,
2637         regmatch_t              *matches,
2638         slap_access_t           *grant,
2639         slap_access_t           *deny,
2640         slap_aci_scope_t        asserted_scope
2641 )
2642 {
2643         struct berval           bv, scope, perms, type, sdn;
2644         int                     rc;
2645
2646
2647         assert( !BER_BVISNULL( &desc->ad_cname ) );
2648
2649         /* parse an aci of the form:
2650                 oid # scope # action;rights;attr;rights;attr
2651                         $ action;rights;attr;rights;attr # type # subject
2652
2653            [NOTE: the following comment is very outdated,
2654            as the draft version it refers to (Ando, 2004-11-20)].
2655
2656            See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
2657            a full description of the format for this attribute.
2658            Differences: "this" in the draft is "self" here, and
2659            "self" and "public" is in the position of type.
2660
2661            <scope> = {entry|children|subtree}
2662            <type> = {public|users|access-id|subtree|onelevel|children|
2663                      self|dnattr|group|role|set|set-ref}
2664
2665            This routine now supports scope={ENTRY,CHILDREN}
2666            with the semantics:
2667              - ENTRY applies to "entry" and "subtree";
2668              - CHILDREN aplies to "children" and "subtree"
2669          */
2670
2671         /* check that the aci has all 5 components */
2672         if ( aci_get_part( aci, 4, '#', NULL ) < 0 ) {
2673                 return 0;
2674         }
2675
2676         /* check that the aci family is supported */
2677         if ( aci_get_part( aci, 0, '#', &bv ) < 0 ) {
2678                 return 0;
2679         }
2680
2681         /* check that the scope matches */
2682         if ( aci_get_part( aci, 1, '#', &scope ) < 0 ) {
2683                 return 0;
2684         }
2685
2686         /* note: scope can be either ENTRY or CHILDREN;
2687          * they respectively match "entry" and "children" in bv
2688          * both match "subtree" */
2689         switch ( asserted_scope ) {
2690         case SLAP_ACI_SCOPE_ENTRY:
2691                 if ( ber_bvstrcasecmp( &scope, &aci_bv_entry ) != 0
2692                                 && ber_bvstrcasecmp( &scope, &aci_bv_subtree ) != 0 )
2693                 {
2694                         return 0;
2695                 }
2696                 break;
2697
2698         case SLAP_ACI_SCOPE_CHILDREN:
2699                 if ( ber_bvstrcasecmp( &scope, &aci_bv_children ) != 0
2700                                 && ber_bvstrcasecmp( &scope, &aci_bv_subtree ) != 0 )
2701                 {
2702                         return 0;
2703                 }
2704                 break;
2705
2706         default:
2707                 return 0;
2708         }
2709
2710         /* get the list of permissions clauses, bail if empty */
2711         if ( aci_get_part( aci, 2, '#', &perms ) <= 0 ) {
2712                 return 0;
2713         }
2714
2715         /* check if any permissions allow desired access */
2716         if ( aci_list_get_rights( &perms, &desc->ad_cname, val, grant, deny ) == 0 ) {
2717                 return 0;
2718         }
2719
2720         /* see if we have a DN match */
2721         if ( aci_get_part( aci, 3, '#', &type ) < 0 ) {
2722                 return 0;
2723         }
2724
2725         /* see if we have a public (i.e. anonymous) access */
2726         if ( ber_bvstrcasecmp( &aci_bv_public, &type ) == 0 ) {
2727                 return 1;
2728         }
2729
2730         /* otherwise require an identity */
2731         if ( BER_BVISNULL( &op->o_ndn ) || BER_BVISEMPTY( &op->o_ndn ) ) {
2732                 return 0;
2733         }
2734
2735         /* see if we have a users access */
2736         if ( ber_bvstrcasecmp( &aci_bv_users, &type ) == 0 ) {
2737                 return 1;
2738         }
2739
2740         /* NOTE: this may fail if a DN contains a valid '#' (unescaped);
2741          * just grab all the berval up to its end (ITS#3303).
2742          * NOTE: the problem could be solved by providing the DN with
2743          * the embedded '#' encoded as hexpairs: "cn=Foo#Bar" would
2744          * become "cn=Foo\23Bar" and be safely used by aci_mask(). */
2745 #if 0
2746         if ( aci_get_part( aci, 4, '#', &sdn ) < 0 ) {
2747                 return 0;
2748         }
2749 #endif
2750         sdn.bv_val = type.bv_val + type.bv_len + STRLENOF( "#" );
2751         sdn.bv_len = aci->bv_len - ( sdn.bv_val - aci->bv_val );
2752
2753         if ( ber_bvstrcasecmp( &aci_bv_access_id, &type ) == 0 ) {
2754                 struct berval ndn;
2755
2756                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
2757                 if ( rc != LDAP_SUCCESS ) {
2758                         return 0;
2759                 }
2760
2761                 if ( dn_match( &op->o_ndn, &ndn ) ) {
2762                         rc = 1;
2763                 }
2764                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2765
2766                 return rc;
2767
2768         } else if ( ber_bvstrcasecmp( &aci_bv_subtree, &type ) == 0 ) {
2769                 struct berval ndn;
2770
2771                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
2772                 if ( rc != LDAP_SUCCESS ) {
2773                         return 0;
2774                 }
2775
2776                 if ( dnIsSuffix( &op->o_ndn, &ndn ) ) {
2777                         rc = 1;
2778                 }
2779                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2780
2781                 return rc;
2782
2783         } else if ( ber_bvstrcasecmp( &aci_bv_onelevel, &type ) == 0 ) {
2784                 struct berval ndn, pndn;
2785
2786                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
2787                 if ( rc != LDAP_SUCCESS ) {
2788                         return 0;
2789                 }
2790
2791                 dnParent( &ndn, &pndn );
2792
2793                 if ( dn_match( &op->o_ndn, &pndn ) ) {
2794                         rc = 1;
2795                 }
2796                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2797
2798                 return rc;
2799
2800         } else if ( ber_bvstrcasecmp( &aci_bv_children, &type ) == 0 ) {
2801                 struct berval ndn;
2802
2803                 rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
2804                 if ( rc != LDAP_SUCCESS ) {
2805                         return 0;
2806                 }
2807
2808                 if ( !dn_match( &op->o_ndn, &ndn )
2809                                 && dnIsSuffix( &op->o_ndn, &ndn ) )
2810                 {
2811                         rc = 1;
2812                 }
2813                 slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
2814
2815                 return rc;
2816
2817         } else if ( ber_bvstrcasecmp( &aci_bv_self, &type ) == 0 ) {
2818                 if ( dn_match( &op->o_ndn, &e->e_nname ) ) {
2819                         return 1;
2820                 }
2821
2822         } else if ( ber_bvstrcasecmp( &aci_bv_dnattr, &type ) == 0 ) {
2823                 Attribute               *at;
2824                 AttributeDescription    *ad = NULL;
2825                 const char              *text;
2826
2827                 rc = slap_bv2ad( &sdn, &ad, &text );
2828
2829                 if( rc != LDAP_SUCCESS ) {
2830                         return 0;
2831                 }
2832
2833                 rc = 0;
2834
2835                 for ( at = attrs_find( e->e_attrs, ad );
2836                                 at != NULL;
2837                                 at = attrs_find( at->a_next, ad ) )
2838                 {
2839                         if ( value_find_ex( ad,
2840                                 SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
2841                                         SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
2842                                 at->a_nvals,
2843                                 &op->o_ndn, op->o_tmpmemctx ) == 0 )
2844                         {
2845                                 rc = 1;
2846                                 break;
2847                         }
2848                 }
2849
2850                 return rc;
2851
2852         } else if ( ber_bvstrcasecmp( &aci_bv_group, &type ) == 0 ) {
2853                 if ( aci_group_member( &sdn, &aci_bv_group_class,
2854                                 &aci_bv_group_attr, op, e, nmatch, matches ) )
2855                 {
2856                         return 1;
2857                 }
2858
2859         } else if ( ber_bvstrcasecmp( &aci_bv_role, &type ) == 0 ) {
2860                 if ( aci_group_member( &sdn, &aci_bv_role_class,
2861                                 &aci_bv_role_attr, op, e, nmatch, matches ) )
2862                 {
2863                         return 1;
2864                 }
2865
2866         } else if ( ber_bvstrcasecmp( &aci_bv_set, &type ) == 0 ) {
2867                 if ( aci_match_set( &sdn, op, e, 0 ) ) {
2868                         return 1;
2869                 }
2870
2871         } else if ( ber_bvstrcasecmp( &aci_bv_set_ref, &type ) == 0 ) {
2872                 if ( aci_match_set( &sdn, op, e, 1 ) ) {
2873                         return 1;
2874                 }
2875         }
2876
2877         return 0;
2878 }
2879
2880 #ifdef SLAP_DYNACL
2881 static int
2882 dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *right, void **privp )
2883 {
2884         AttributeDescription    *ad = NULL;
2885         const char              *text = NULL;
2886
2887         if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
2888                 fprintf( stderr, "%s: line %d: "
2889                         "inappropriate style \"%s\" in \"aci\" by clause\n",
2890                         fname, lineno, sty );
2891                 return -1;
2892         }
2893
2894         if ( right != NULL && *right != '\0' ) {
2895                 if ( slap_str2ad( right, &ad, &text ) != LDAP_SUCCESS ) {
2896                         fprintf( stderr,
2897                                 "%s: line %d: aci \"%s\": %s\n",
2898                                 fname, lineno, right, text );
2899                         return -1;
2900                 }
2901
2902         } else {
2903                 ad = slap_schema.si_ad_aci;
2904         }
2905
2906         if ( !is_at_syntax( ad->ad_type, SLAPD_ACI_SYNTAX) ) {
2907                 fprintf( stderr, "%s: line %d: "
2908                         "aci \"%s\": inappropriate syntax: %s\n",
2909                         fname, lineno, right,
2910                         ad->ad_type->sat_syntax_oid );
2911                 return -1;
2912         }
2913
2914         *privp = (void *)ad;
2915
2916         return 0;
2917 }
2918
2919 static int
2920 dynacl_aci_unparse( void *priv, struct berval *bv )
2921 {
2922         AttributeDescription    *ad = ( AttributeDescription * )priv;
2923         char *ptr;
2924
2925         assert( ad );
2926
2927         bv->bv_val = ch_malloc( STRLENOF(" aci=") + ad->ad_cname.bv_len + 1 );
2928         ptr = lutil_strcopy( bv->bv_val, " aci=" );
2929         ptr = lutil_strcopy( ptr, ad->ad_cname.bv_val );
2930         bv->bv_len = ptr - bv->bv_val;
2931
2932         return 0;
2933 }
2934
2935
2936 static int
2937 dynacl_aci_mask(
2938                 void                    *priv,
2939                 Operation               *op,
2940                 Entry                   *e,
2941                 AttributeDescription    *desc,
2942                 struct berval           *val,
2943                 int                     nmatch,
2944                 regmatch_t              *matches,
2945                 slap_access_t           *grantp,
2946                 slap_access_t           *denyp )
2947 {
2948         AttributeDescription    *ad = ( AttributeDescription * )priv;
2949         Attribute               *at;
2950         slap_access_t           tgrant, tdeny, grant, deny;
2951 #ifdef LDAP_DEBUG
2952         char                    accessmaskbuf[ACCESSMASK_MAXLEN];
2953         char                    accessmaskbuf1[ACCESSMASK_MAXLEN];
2954 #endif /* LDAP_DEBUG */
2955
2956         /* start out with nothing granted, nothing denied */
2957         ACL_INIT(tgrant);
2958         ACL_INIT(tdeny);
2959
2960         /* get the aci attribute */
2961         at = attr_find( e->e_attrs, ad );
2962         if ( at != NULL ) {
2963                 int             i;
2964
2965                 /* the aci is an multi-valued attribute.  The
2966                  * rights are determined by OR'ing the individual
2967                  * rights given by the acis.
2968                  */
2969                 for ( i = 0; !BER_BVISNULL( &at->a_nvals[i] ); i++ ) {
2970                         if ( aci_mask( op, e, desc, val, &at->a_nvals[i],
2971                                         nmatch, matches, &grant, &deny,
2972                                         SLAP_ACI_SCOPE_ENTRY ) != 0 )
2973                         {
2974                                 tgrant |= grant;
2975                                 tdeny |= deny;
2976                         }
2977                 }
2978
2979                 Debug( LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
2980                           accessmask2str( tgrant, accessmaskbuf, 1 ),
2981                           accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
2982         }
2983
2984         /* If the entry level aci didn't contain anything valid for the
2985          * current operation, climb up the tree and evaluate the
2986          * acis with scope set to subtree
2987          */
2988         if ( tgrant == ACL_PRIV_NONE && tdeny == ACL_PRIV_NONE ) {
2989                 struct berval   parent_ndn;
2990
2991 #if 1
2992                 /* to solve the chicken'n'egg problem of accessing
2993                  * the OpenLDAPaci attribute, the direct access
2994                  * to the entry's attribute is unchecked; however,
2995                  * further accesses to OpenLDAPaci values in the
2996                  * ancestors occur through backend_attribute(), i.e.
2997                  * with the identity of the operation, requiring
2998                  * further access checking.  For uniformity, this
2999                  * makes further requests occur as the rootdn, if
3000                  * any, i.e. searching for the OpenLDAPaci attribute
3001                  * is considered an internal search.  If this is not
3002                  * acceptable, then the same check needs be performed
3003                  * when accessing the entry's attribute. */
3004                 Operation       op2 = *op;
3005
3006                 if ( !BER_BVISNULL( &op->o_bd->be_rootndn ) ) {
3007                         op2.o_dn = op->o_bd->be_rootdn;
3008                         op2.o_ndn = op->o_bd->be_rootndn;
3009                 }
3010 #endif
3011
3012                 dnParent( &e->e_nname, &parent_ndn );
3013                 while ( !BER_BVISEMPTY( &parent_ndn ) ){
3014                         int             i;
3015                         BerVarray       bvals = NULL;
3016                         int             ret, stop;
3017
3018                         Debug( LDAP_DEBUG_ACL, "checking ACI of \"%s\"\n", parent_ndn.bv_val, 0, 0 );
3019                         ret = backend_attribute( &op2, NULL, &parent_ndn, ad, &bvals, ACL_AUTH );
3020
3021                         switch ( ret ) {
3022                         case LDAP_SUCCESS :
3023                                 stop = 0;
3024                                 if ( !bvals ) {
3025                                         break;
3026                                 }
3027
3028                                 for ( i = 0; !BER_BVISNULL( &bvals[i] ); i++) {
3029                                         if ( aci_mask( op, e, desc, val,
3030                                                         &bvals[i],
3031                                                         nmatch, matches,
3032                                                         &grant, &deny,
3033                                                         SLAP_ACI_SCOPE_CHILDREN ) != 0 )
3034                                         {
3035                                                 tgrant |= grant;
3036                                                 tdeny |= deny;
3037                                                 /* evaluation stops as soon as either a "deny" or a
3038                                                  * "grant" directive matches.
3039                                                  */
3040                                                 if ( tgrant != ACL_PRIV_NONE || tdeny != ACL_PRIV_NONE ) {
3041                                                         stop = 1;
3042                                                 }
3043                                         }
3044                                         Debug( LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
3045                                                 accessmask2str( tgrant, accessmaskbuf, 1 ),
3046                                                 accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
3047                                 }
3048                                 break;
3049
3050                         case LDAP_NO_SUCH_ATTRIBUTE:
3051                                 /* just go on if the aci-Attribute is not present in
3052                                  * the current entry
3053                                  */
3054                                 Debug( LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0 );
3055                                 stop = 0;
3056                                 break;
3057
3058                         case LDAP_NO_SUCH_OBJECT:
3059                                 /* We have reached the base object */
3060                                 Debug( LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0 );
3061                                 stop = 1;
3062                                 break;
3063
3064                         default:
3065                                 stop = 1;
3066                                 break;
3067                         }
3068
3069                         if ( stop ) {
3070                                 break;
3071                         }
3072                         dnParent( &parent_ndn, &parent_ndn );
3073                 }
3074         }
3075
3076         *grantp = tgrant;
3077         *denyp = tdeny;
3078
3079         return 0;
3080 }
3081
3082 /* need to register this at some point */
3083 static slap_dynacl_t    dynacl_aci = {
3084         "aci",
3085         dynacl_aci_parse,
3086         dynacl_aci_unparse,
3087         dynacl_aci_mask,
3088         NULL,
3089         NULL,
3090         NULL
3091 };
3092
3093 #endif /* SLAP_DYNACL */
3094
3095 #endif  /* SLAPD_ACI_ENABLED */
3096
3097 #ifdef SLAP_DYNACL
3098
3099 /*
3100  * dynamic ACL infrastructure
3101  */
3102 static slap_dynacl_t    *da_list = NULL;
3103
3104 int
3105 slap_dynacl_register( slap_dynacl_t *da )
3106 {
3107         slap_dynacl_t   *tmp;
3108
3109         for ( tmp = da_list; tmp; tmp = tmp->da_next ) {
3110                 if ( strcasecmp( da->da_name, tmp->da_name ) == 0 ) {
3111                         break;
3112                 }
3113         }
3114
3115         if ( tmp != NULL ) {
3116                 return -1;
3117         }
3118
3119         if ( da->da_mask == NULL ) {
3120                 return -1;
3121         }
3122
3123         da->da_private = NULL;
3124         da->da_next = da_list;
3125         da_list = da;
3126
3127         return 0;
3128 }
3129
3130 static slap_dynacl_t *
3131 slap_dynacl_next( slap_dynacl_t *da )
3132 {
3133         if ( da ) {
3134                 return da->da_next;
3135         }
3136         return da_list;
3137 }
3138
3139 slap_dynacl_t *
3140 slap_dynacl_get( const char *name )
3141 {
3142         slap_dynacl_t   *da;
3143
3144         for ( da = slap_dynacl_next( NULL ); da; da = slap_dynacl_next( da ) ) {
3145                 if ( strcasecmp( da->da_name, name ) == 0 ) {
3146                         break;
3147                 }
3148         }
3149
3150         return da;
3151 }
3152 #endif /* SLAP_DYNACL */
3153
3154 int
3155 acl_init( void )
3156 {
3157         int             i, rc;
3158 #ifdef SLAP_DYNACL
3159         slap_dynacl_t   *known_dynacl[] = {
3160 #ifdef SLAPD_ACI_ENABLED
3161                 &dynacl_aci,
3162 #endif  /* SLAPD_ACI_ENABLED */
3163                 NULL
3164         };
3165
3166         for ( i = 0; known_dynacl[ i ]; i++ ) {
3167                 rc = slap_dynacl_register( known_dynacl[ i ] );
3168                 if ( rc ) {
3169                         return rc;
3170                 }
3171         }
3172 #endif /* SLAP_DYNACL */
3173
3174         return 0;
3175 }
3176
3177 static int
3178 string_expand(
3179         struct berval   *bv,
3180         struct berval   *pat,
3181         char            *match,
3182         int             nmatch,
3183         regmatch_t      *matches)
3184 {
3185         ber_len_t       size;
3186         char   *sp;
3187         char   *dp;
3188         int     flag;
3189
3190         size = 0;
3191         bv->bv_val[0] = '\0';
3192         bv->bv_len--; /* leave space for lone $ */
3193
3194         flag = 0;
3195         for ( dp = bv->bv_val, sp = pat->bv_val; size < bv->bv_len &&
3196                 sp < pat->bv_val + pat->bv_len ; sp++ )
3197         {
3198                 /* did we previously see a $ */
3199                 if ( flag ) {
3200                         if ( flag == 1 && *sp == '$' ) {
3201                                 *dp++ = '$';
3202                                 size++;
3203                                 flag = 0;
3204
3205                         } else if ( flag == 1 && *sp == '{' /*'}'*/) {
3206                                 flag = 2;
3207
3208                         } else if ( *sp >= '0' && *sp <= '9' ) {
3209                                 int     n;
3210                                 int     i;
3211                                 int     l;
3212
3213                                 n = *sp - '0';
3214
3215                                 if ( flag == 2 ) {
3216                                         for ( sp++; *sp != '\0' && *sp != /*'{'*/ '}'; sp++ ) {
3217                                                 if ( *sp >= '0' && *sp <= '9' ) {
3218                                                         n = 10*n + ( *sp - '0' );
3219                                                 }
3220                                         }
3221
3222                                         if ( *sp != /*'{'*/ '}' ) {
3223                                                 /* FIXME: error */
3224                                                 return 1;
3225                                         }
3226                                 }
3227
3228                                 if ( n >= nmatch ) {
3229                                         /* FIXME: error */
3230                                         return 1;
3231                                 }
3232
3233                                 *dp = '\0';
3234                                 i = matches[n].rm_so;
3235                                 l = matches[n].rm_eo;
3236                                 for ( ; size < bv->bv_len && i < l; size++, i++ ) {
3237                                         *dp++ = match[i];
3238                                 }
3239                                 *dp = '\0';
3240
3241                                 flag = 0;
3242                         }
3243                 } else {
3244                         if (*sp == '$') {
3245                                 flag = 1;
3246                         } else {
3247                                 *dp++ = *sp;
3248                                 size++;
3249                         }
3250                 }
3251         }
3252
3253         if ( flag ) {
3254                 /* must have ended with a single $ */
3255                 *dp++ = '$';
3256                 size++;
3257         }
3258
3259         *dp = '\0';
3260         bv->bv_len = size;
3261
3262         Debug( LDAP_DEBUG_TRACE, "=> string_expand: pattern:  %.*s\n", (int)pat->bv_len, pat->bv_val, 0 );
3263         Debug( LDAP_DEBUG_TRACE, "=> string_expand: expanded: %s\n", bv->bv_val, 0, 0 );
3264
3265         return 0;
3266 }
3267
3268 static int
3269 regex_matches(
3270         struct berval   *pat,           /* pattern to expand and match against */
3271         char            *str,           /* string to match against pattern */
3272         char            *buf,           /* buffer with $N expansion variables */
3273         int             nmatch, /* size of the matches array */
3274         regmatch_t      *matches        /* offsets in buffer for $N expansion variables */
3275 )
3276 {
3277         regex_t re;
3278         char newbuf[ACL_BUF_SIZE];
3279         struct berval bv;
3280         int     rc;
3281
3282         bv.bv_len = sizeof( newbuf ) - 1;
3283         bv.bv_val = newbuf;
3284
3285         if (str == NULL) {
3286                 str = "";
3287         };
3288
3289         string_expand( &bv, pat, buf, nmatch, matches );
3290         rc = regcomp( &re, newbuf, REG_EXTENDED|REG_ICASE );
3291         if ( rc ) {
3292                 char error[ACL_BUF_SIZE];
3293                 regerror( rc, &re, error, sizeof( error ) );
3294
3295                 Debug( LDAP_DEBUG_TRACE,
3296                     "compile( \"%s\", \"%s\") failed %s\n",
3297                         pat->bv_val, str, error );
3298                 return( 0 );
3299         }
3300
3301         rc = regexec( &re, str, 0, NULL, 0 );
3302         regfree( &re );
3303
3304         Debug( LDAP_DEBUG_TRACE,
3305             "=> regex_matches: string:   %s\n", str, 0, 0 );
3306         Debug( LDAP_DEBUG_TRACE,
3307             "=> regex_matches: rc: %d %s\n",
3308                 rc, !rc ? "matches" : "no matches", 0 );
3309         return( !rc );
3310 }
3311