git.sur5r.net Git - openldap/blob - servers/slapd/acl.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/regex.h>
  13 #include <ac/socket.h>
  14 #include <ac/string.h>
  15
  16 #include "slap.h"
  17 #include "sets.h"
  18
  19 static AccessControl * acl_get(
  20         AccessControl *ac, int *count,
  21         Backend *be, Operation *op,
  22         Entry *e,
  23         AttributeDescription *desc,
  24         int nmatches, regmatch_t *matches );
  25
  26 static slap_control_t acl_mask(
  27         AccessControl *ac, slap_mask_t *mask,
  28         Backend *be, Connection *conn, Operation *op,
  29         Entry *e,
  30         AttributeDescription *desc,
  31         struct berval *val,
  32         regmatch_t *matches );
  33
  34 #ifdef SLAPD_ACI_ENABLED
  35 static int aci_mask(
  36         Backend *be,
  37     Connection *conn,
  38         Operation *op,
  39         Entry *e,
  40         AttributeDescription *desc,
  41         struct berval *val,
  42         struct berval *aci,
  43         regmatch_t *matches,
  44         slap_access_t *grant,
  45         slap_access_t *deny );
  46 #endif
  47
  48 static int      regex_matches(
  49         char *pat, char *str, char *buf, regmatch_t *matches);
  50 static void     string_expand(
  51         struct berval *newbuf, char *pattern,
  52         char *match, regmatch_t *matches);
  53
  54 typedef struct AciSetCookie {
  55         Backend *be;
  56         Entry *e;
  57         Connection *conn;
  58         Operation *op;
  59 } AciSetCookie;
  60
  61 BerVarray aci_set_gather (void *cookie, char *name, struct berval *attr);
  62 static int aci_match_set ( struct berval *subj, Backend *be,
  63     Entry *e, Connection *conn, Operation *op, int setref );
  64
  65 /*
  66  * access_allowed - check whether op->o_ndn is allowed the requested access
  67  * to entry e, attribute attr, value val.  if val is null, access to
  68  * the whole attribute is assumed (all values).
  69  *
  70  * This routine loops through all access controls and calls
  71  * acl_mask() on each applicable access control.
  72  * The loop exits when a definitive answer is reached or
  73  * or no more controls remain.
  74  *
  75  * returns:
  76  *              0       access denied
  77  *              1       access granted
  78  */
  79
  80 int
  81 access_allowed(
  82     Backend             *be,
  83     Connection          *conn,
  84     Operation           *op,
  85     Entry               *e,
  86         AttributeDescription    *desc,
  87     struct berval       *val,
  88     slap_access_t       access )
  89 {
  90         int                             count;
  91         AccessControl   *a;
  92 #ifdef LDAP_DEBUG
  93         char accessmaskbuf[ACCESSMASK_MAXLEN];
  94 #endif
  95         slap_mask_t mask;
  96         slap_control_t control;
  97         const char *attr;
  98         regmatch_t matches[MAXREMATCHES];
  99
 100         assert( e != NULL );
 101         assert( desc != NULL );
 102         assert( access > ACL_NONE );
 103
 104         attr = desc->ad_cname.bv_val;
 105
 106         assert( attr != NULL );
 107
 108 #ifdef NEW_LOGGING
 109         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 110                 "access_allowed: conn %d %s access to \"%s\" \"%s\" requested\n",
 111                 conn ? conn->c_connid : -1, access2str( access ), e->e_dn, attr ));
 112 #else
 113         Debug( LDAP_DEBUG_ACL,
 114                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 115             access2str( access ), e->e_dn, attr );
 116 #endif
 117
 118         if ( op == NULL ) {
 119                 /* no-op call */
 120                 return 1;
 121         }
 122
 123         if ( be == NULL ) be = &backends[0];
 124         assert( be != NULL );
 125
 126         /* grant database root access */
 127         if ( be != NULL && be_isroot( be, &op->o_ndn ) ) {
 128 #ifdef NEW_LOGGING
 129                 LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
 130                        "access_allowed: conn %d root access granted\n",
 131                        conn->c_connid));
 132 #else
 133                 Debug( LDAP_DEBUG_ACL,
 134                     "<= root access granted\n",
 135                         0, 0, 0 );
 136 #endif
 137                 return 1;
 138         }
 139
 140         /*
 141          * no-user-modification operational attributes are ignored
 142          * by ACL_WRITE checking as any found here are not provided
 143          * by the user
 144          */
 145         if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 146                 && desc != slap_schema.si_ad_entry
 147                 && desc != slap_schema.si_ad_children )
 148         {
 149 #ifdef NEW_LOGGING
 150                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 151                        "access_allowed: conn %d NoUserMod Operational attribute: %s access granted\n",
 152                        conn->c_connid, attr ));
 153 #else
 154                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 155                         " %s access granted\n",
 156                         attr, 0, 0 );
 157 #endif
 158                 return 1;
 159         }
 160
 161         /* use backend default access if no backend acls */
 162         if( be != NULL && be->be_acl == NULL ) {
 163 #ifdef NEW_LOGGING
 164                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 165                        "access_allowed: conn %d backend default %s access %s to \"%s\"\n",
 166                        conn->c_connid, access2str( access ),
 167                        be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val ));
 168 #else
 169                 Debug( LDAP_DEBUG_ACL,
 170                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
 171                         access2str( access ),
 172                         be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val );
 173 #endif
 174                 return be->be_dfltaccess >= access;
 175
 176 #ifdef notdef
 177         /* be is always non-NULL */
 178         /* use global default access if no global acls */
 179         } else if ( be == NULL && global_acl == NULL ) {
 180 #ifdef NEW_LOGGING
 181                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 182                        "access_allowed: conn %d global default %s access %s to \"%s\"\n",
 183                        conn->c_connid, access2str( access ),
 184                        global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val ));
 185 #else
 186                 Debug( LDAP_DEBUG_ACL,
 187                         "=> access_allowed: global default %s access %s to \"%s\"\n",
 188                         access2str( access ),
 189                         global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val );
 190 #endif
 191                 return global_default_access >= access;
 192 #endif
 193         }
 194
 195         ACL_INIT(mask);
 196         memset(matches, '\0', sizeof(matches));
 197
 198         control = ACL_BREAK;
 199         a = NULL;
 200         count = 0;
 201
 202         while((a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches )) != NULL)
 203         {
 204                 int i;
 205
 206                 for (i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++) {
 207 #ifdef NEW_LOGGING
 208                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 209                                "access_allowed: conn %d match[%d]:  %d %d ",
 210                                conn->c_connid, i, (int)matches[i].rm_so, (int)matches[i].rm_eo ));
 211 #else
 212                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 213                                (int)matches[i].rm_so, (int)matches[i].rm_eo );
 214 #endif
 215                         if( matches[i].rm_so <= matches[0].rm_eo ) {
 216                                 int n;
 217                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++) {
 218                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 219                                 }
 220                         }
 221 #ifdef NEW_LOGGING
 222                         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS, "\n" ));
 223 #else
 224                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 225 #endif
 226                 }
 227
 228                 control = acl_mask( a, &mask, be, conn, op,
 229                         e, desc, val, matches );
 230
 231                 if ( control != ACL_BREAK ) {
 232                         break;
 233                 }
 234
 235                 memset(matches, '\0', sizeof(matches));
 236         }
 237
 238         if ( ACL_IS_INVALID( mask ) ) {
 239 #ifdef NEW_LOGGING
 240                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 241                        "access_allowed: conn %d  \"%s\" (%s) invalid!\n",
 242                        conn->c_connid, e->e_dn, attr ));
 243 #else
 244                 Debug( LDAP_DEBUG_ACL,
 245                         "=> access_allowed: \"%s\" (%s) invalid!\n",
 246                         e->e_dn, attr, 0 );
 247 #endif
 248                 ACL_INIT( mask );
 249
 250         } else if ( control == ACL_BREAK ) {
 251 #ifdef NEW_LOGGING
 252                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 253                        "access_allowed: conn %d  no more rules\n", conn->c_connid ));
 254 #else
 255                 Debug( LDAP_DEBUG_ACL,
 256                         "=> access_allowed: no more rules\n", 0, 0, 0);
 257 #endif
 258                 ACL_INIT( mask );
 259         }
 260
 261 #ifdef NEW_LOGGING
 262         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 263                    "access_allowed: conn %d  %s access %s by %s\n",
 264                    conn->c_connid,
 265                    access2str( access ),
 266                    ACL_GRANT( mask, access ) ? "granted" : "denied",
 267                    accessmask2str( mask, accessmaskbuf ) ));
 268 #else
 269         Debug( LDAP_DEBUG_ACL,
 270                 "=> access_allowed: %s access %s by %s\n",
 271                 access2str( access ),
 272                 ACL_GRANT(mask, access) ? "granted" : "denied",
 273                 accessmask2str( mask, accessmaskbuf ) );
 274 #endif
 275         return ACL_GRANT(mask, access);
 276 }
 277
 278 /*
 279  * acl_get - return the acl applicable to entry e, attribute
 280  * attr.  the acl returned is suitable for use in subsequent calls to
 281  * acl_access_allowed().
 282  */
 283
 284 static AccessControl *
 285 acl_get(
 286         AccessControl *a,
 287         int                     *count,
 288     Backend             *be,
 289     Operation   *op,
 290     Entry               *e,
 291         AttributeDescription *desc,
 292     int                 nmatch,
 293     regmatch_t  *matches )
 294 {
 295         const char *attr;
 296         int dnlen, patlen;
 297
 298         assert( e != NULL );
 299         assert( count != NULL );
 300         assert( desc != NULL );
 301
 302         attr = desc->ad_cname.bv_val;
 303
 304         assert( attr != NULL );
 305
 306         if( a == NULL ) {
 307                 if( be == NULL ) {
 308                         a = global_acl;
 309                 } else {
 310                         a = be->be_acl;
 311                 }
 312
 313                 assert( a != NULL );
 314
 315         } else {
 316                 a = a->acl_next;
 317         }
 318
 319         dnlen = e->e_nname.bv_len;
 320
 321         for ( ; a != NULL; a = a->acl_next ) {
 322                 (*count) ++;
 323
 324                 if (a->acl_dn_pat.bv_len != 0) {
 325                         if ( a->acl_dn_style == ACL_STYLE_REGEX ) {
 326 #ifdef NEW_LOGGING
 327                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 328                                            "acl_get: dnpat [%d] %s nsub: %d\n",
 329                                            *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub ));
 330 #else
 331                                 Debug( LDAP_DEBUG_ACL, "=> dnpat: [%d] %s nsub: %d\n",
 332                                         *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub );
 333 #endif
 334                                 if (regexec(&a->acl_dn_re, e->e_ndn, nmatch, matches, 0))
 335                                         continue;
 336
 337                         } else {
 338 #ifdef NEW_LOGGING
 339                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 340                                            "acl_get: dn [%d] %s\n",
 341                                            *count, a->acl_dn_pat.bv_val ));
 342 #else
 343                                 Debug( LDAP_DEBUG_ACL, "=> dn: [%d] %s\n",
 344                                         *count, a->acl_dn_pat.bv_val, 0 );
 345 #endif
 346                                 patlen = a->acl_dn_pat.bv_len;
 347                                 if ( dnlen < patlen )
 348                                         continue;
 349
 350                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 351                                         /* base dn -- entire object DN must match */
 352                                         if ( dnlen != patlen )
 353                                                 continue;
 354
 355                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 356                                         int rdnlen = -1;
 357
 358                                         if ( dnlen <= patlen )
 359                                                 continue;
 360
 361                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 362                                                 continue;
 363
 364                                         rdnlen = dn_rdnlen( NULL, &e->e_nname );
 365                                         if ( rdnlen != dnlen - patlen - 1 )
 366                                                 continue;
 367
 368                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 369                                         if ( dnlen > patlen && ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) ) )
 370                                                 continue;
 371
 372                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 373                                         if ( dnlen <= patlen )
 374                                                 continue;
 375                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 376                                                 continue;
 377                                 }
 378
 379                                 if ( strcmp( a->acl_dn_pat.bv_val, e->e_ndn + dnlen - patlen ) != 0 )
 380                                         continue;
 381                         }
 382
 383 #ifdef NEW_LOGGING
 384                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 385                                    "acl_get: [%d] matched\n",
 386                                    *count ));
 387 #else
 388                         Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] matched\n",
 389                                 *count, 0, 0 );
 390 #endif
 391                 }
 392
 393                 if ( a->acl_filter != NULL ) {
 394                         ber_int_t rc = test_filter( NULL, NULL, NULL, e, a->acl_filter );
 395                         if ( rc != LDAP_COMPARE_TRUE ) {
 396                                 continue;
 397                         }
 398                 }
 399
 400 #ifdef NEW_LOGGING
 401                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 402                            "acl_get: [%d] check attr %s\n",
 403                            *count, attr ));
 404 #else
 405                 Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] check attr %s\n",
 406                        *count, attr, 0);
 407 #endif
 408                 if ( attr == NULL || a->acl_attrs == NULL ||
 409                         ad_inlist( desc, a->acl_attrs ) )
 410                 {
 411 #ifdef NEW_LOGGING
 412                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 413                                    "acl_get:  [%d] acl %s attr: %s\n",
 414                                    *count, e->e_dn, attr ));
 415 #else
 416                         Debug( LDAP_DEBUG_ACL,
 417                                 "<= acl_get: [%d] acl %s attr: %s\n",
 418                                 *count, e->e_dn, attr );
 419 #endif
 420                         return a;
 421                 }
 422                 matches[0].rm_so = matches[0].rm_eo = -1;
 423         }
 424
 425 #ifdef NEW_LOGGING
 426         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 427                    "acl_get: done.\n" ));
 428 #else
 429         Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
 430 #endif
 431         return( NULL );
 432 }
 433
 434
 435 /*
 436  * acl_mask - modifies mask based upon the given acl and the
 437  * requested access to entry e, attribute attr, value val.  if val
 438  * is null, access to the whole attribute is assumed (all values).
 439  *
 440  * returns      0       access NOT allowed
 441  *              1       access allowed
 442  */
 443
 444 static slap_control_t
 445 acl_mask(
 446     AccessControl       *a,
 447         slap_mask_t *mask,
 448     Backend             *be,
 449     Connection  *conn,
 450     Operation   *op,
 451     Entry               *e,
 452         AttributeDescription *desc,
 453     struct berval       *val,
 454         regmatch_t      *matches
 455 )
 456 {
 457         int             i, odnlen, patlen;
 458         Access  *b;
 459 #ifdef LDAP_DEBUG
 460         char accessmaskbuf[ACCESSMASK_MAXLEN];
 461 #endif
 462         const char *attr;
 463
 464         assert( a != NULL );
 465         assert( mask != NULL );
 466         assert( desc != NULL );
 467
 468         attr = desc->ad_cname.bv_val;
 469
 470         assert( attr != NULL );
 471
 472 #ifdef NEW_LOGGING
 473         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 474                    "acl_mask: conn %d  access to entry \"%s\", attr \"%s\" requested\n",
 475                    conn->c_connid, e->e_dn, attr ));
 476
 477         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS,
 478                    " to %s by \"%s\", (%s) \n",
 479                    val ? "value" : "all values",
 480                    op->o_ndn.bv_val ? op->o_ndn.bv_val : "",
 481                    accessmask2str( *mask, accessmaskbuf ) ));
 482 #else
 483         Debug( LDAP_DEBUG_ACL,
 484                 "=> acl_mask: access to entry \"%s\", attr \"%s\" requested\n",
 485                 e->e_dn, attr, 0 );
 486
 487         Debug( LDAP_DEBUG_ACL,
 488                 "=> acl_mask: to %s by \"%s\", (%s) \n",
 489                 val ? "value" : "all values",
 490                 op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
 491                 accessmask2str( *mask, accessmaskbuf ) );
 492 #endif
 493
 494         for ( i = 1, b = a->acl_access; b != NULL; b = b->a_next, i++ ) {
 495                 slap_mask_t oldmask, modmask;
 496
 497                 ACL_INVALIDATE( modmask );
 498
 499                 /* AND <who> clauses */
 500                 if ( b->a_dn_pat.bv_len != 0 ) {
 501 #ifdef NEW_LOGGING
 502                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 503                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 504                                    conn->c_connid, b->a_dn_pat.bv_val ));
 505 #else
 506                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
 507                                 b->a_dn_pat.bv_val, 0, 0);
 508 #endif
 509                         /*
 510                          * if access applies to the entry itself, and the
 511                          * user is bound as somebody in the same namespace as
 512                          * the entry, OR the given dn matches the dn pattern
 513                          */
 514                         if ( b->a_dn_pat.bv_len == sizeof("anonymous") -1 &&
 515                             strcmp( b->a_dn_pat.bv_val, "anonymous" ) == 0 ) {
 516                                 if (op->o_ndn.bv_len != 0 ) {
 517                                         continue;
 518                                 }
 519
 520                         } else if ( b->a_dn_pat.bv_len == sizeof("users") - 1 &&
 521                             strcmp( b->a_dn_pat.bv_val, "users" ) == 0 ) {
 522                                 if (op->o_ndn.bv_len == 0 ) {
 523                                         continue;
 524                                 }
 525
 526                         } else if ( b->a_dn_pat.bv_len == sizeof("self") - 1 &&
 527                             strcmp( b->a_dn_pat.bv_val, "self" ) == 0 ) {
 528                                 if( op->o_ndn.bv_len == 0 ) {
 529                                         continue;
 530                                 }
 531
 532                                 if ( e->e_dn == NULL || strcmp( e->e_ndn, op->o_ndn.bv_val ) != 0 ) {
 533                                         continue;
 534                                 }
 535
 536                         } else if ( b->a_dn_style == ACL_STYLE_REGEX ) {
 537                                 if ( b->a_dn_pat.bv_len != 1 ||
 538                                     strcmp( b->a_dn_pat.bv_val, "*" ) != 0 ) {
 539                                         int ret = regex_matches( b->a_dn_pat.bv_val,
 540                                                 op->o_ndn.bv_val, e->e_ndn, matches );
 541
 542                                         if( ret == 0 ) {
 543                                                 continue;
 544                                         }
 545                                 }
 546
 547                         } else {
 548                                 if ( e->e_dn == NULL )
 549                                         continue;
 550
 551                                 patlen = b->a_dn_pat.bv_len;
 552                                 odnlen = op->o_ndn.bv_len;
 553                                 if ( odnlen < patlen )
 554                                         continue;
 555
 556                                 if ( b->a_dn_style == ACL_STYLE_BASE ) {
 557                                         /* base dn -- entire object DN must match */
 558                                         if ( odnlen != patlen )
 559                                                 continue;
 560
 561                                 } else if ( b->a_dn_style == ACL_STYLE_ONE ) {
 562                                         int rdnlen = -1;
 563
 564                                         if ( odnlen <= patlen )
 565                                                 continue;
 566
 567                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 568                                                 continue;
 569
 570                                         rdnlen = dn_rdnlen( NULL, &op->o_ndn );
 571                                         if ( rdnlen != odnlen - patlen - 1 )
 572                                                 continue;
 573
 574                                 } else if ( b->a_dn_style == ACL_STYLE_SUBTREE ) {
 575                                         if ( odnlen > patlen && ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) ) )
 576                                                 continue;
 577
 578                                 } else if ( b->a_dn_style == ACL_STYLE_CHILDREN ) {
 579                                         if ( odnlen <= patlen )
 580                                                 continue;
 581                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 582                                                 continue;
 583                                 }
 584
 585                                 if ( strcmp( b->a_dn_pat.bv_val, op->o_ndn.bv_val + odnlen - patlen ) != 0 )
 586                                         continue;
 587
 588                         }
 589                 }
 590
 591                 if ( b->a_sockurl_pat != NULL ) {
 592 #ifdef NEW_LOGGING
 593                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 594                                    "acl_mask: conn %d  check a_sockurl_pat: %s\n",
 595                                    conn->c_connid, b->a_sockurl_pat ));
 596 #else
 597                         Debug( LDAP_DEBUG_ACL, "<= check a_sockurl_pat: %s\n",
 598                                 b->a_sockurl_pat, 0, 0 );
 599 #endif
 600
 601                         if ( strcmp( b->a_sockurl_pat, "*" ) != 0) {
 602                                 if ( b->a_sockurl_style == ACL_STYLE_REGEX) {
 603                                         if (!regex_matches( b->a_sockurl_pat, conn->c_listener_url,
 604                                                         e->e_ndn, matches ) )
 605                                         {
 606                                                 continue;
 607                                         }
 608                                 } else {
 609                                         if ( strcasecmp( b->a_sockurl_pat, conn->c_listener_url ) != 0 )
 610                                                 continue;
 611                                 }
 612                         }
 613                 }
 614
 615                 if ( b->a_domain_pat != NULL ) {
 616 #ifdef NEW_LOGGING
 617                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 618                                    "acl_mask: conn %d  check a_domain_pat: %s\n",
 619                                    conn->c_connid, b->a_domain_pat ));
 620 #else
 621                         Debug( LDAP_DEBUG_ACL, "<= check a_domain_pat: %s\n",
 622                                 b->a_domain_pat, 0, 0 );
 623 #endif
 624                         if ( strcmp( b->a_domain_pat, "*" ) != 0) {
 625                                 if ( b->a_domain_style == ACL_STYLE_REGEX) {
 626                                         if (!regex_matches( b->a_domain_pat, conn->c_peer_domain,
 627                                                         e->e_ndn, matches ) )
 628                                         {
 629                                                 continue;
 630                                         }
 631                                 } else {
 632                                         if ( strcasecmp( b->a_domain_pat, conn->c_peer_domain ) != 0 )
 633                                                 continue;
 634                                 }
 635                         }
 636                 }
 637
 638                 if ( b->a_peername_pat != NULL ) {
 639 #ifdef NEW_LOGGING
 640                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 641                                    "acl_mask: conn %d  check a_perrname_path: %s\n",
 642                                    conn->c_connid, b->a_peername_pat ));
 643 #else
 644                         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
 645                                 b->a_peername_pat, 0, 0 );
 646 #endif
 647                         if ( strcmp( b->a_peername_pat, "*" ) != 0) {
 648                                 if ( b->a_peername_style == ACL_STYLE_REGEX) {
 649                                         if (!regex_matches( b->a_peername_pat, conn->c_peer_name,
 650                                                         e->e_ndn, matches ) )
 651                                         {
 652                                                 continue;
 653                                         }
 654                                 } else {
 655                                         if ( strcasecmp( b->a_peername_pat, conn->c_peer_name ) != 0 )
 656                                                 continue;
 657                                 }
 658                         }
 659                 }
 660
 661                 if ( b->a_sockname_pat != NULL ) {
 662 #ifdef NEW_LOGGING
 663                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 664                                    "acl_mask: conn %d  check a_sockname_path: %s\n",
 665                                    conn->c_connid, b->a_sockname_pat ));
 666 #else
 667                         Debug( LDAP_DEBUG_ACL, "<= check a_sockname_path: %s\n",
 668                                 b->a_sockname_pat, 0, 0 );
 669 #endif
 670                         if ( strcmp( b->a_sockname_pat, "*" ) != 0) {
 671                                 if ( b->a_sockname_style == ACL_STYLE_REGEX) {
 672                                         if (!regex_matches( b->a_sockname_pat, conn->c_sock_name,
 673                                                         e->e_ndn, matches ) )
 674                                         {
 675                                                 continue;
 676                                         }
 677                                 } else {
 678                                         if ( strcasecmp( b->a_sockname_pat, conn->c_sock_name ) != 0 )
 679                                                 continue;
 680                                 }
 681                         }
 682                 }
 683
 684                 if ( b->a_dn_at != NULL && op->o_ndn.bv_len != 0 ) {
 685                         Attribute       *at;
 686                         struct berval   bv;
 687                         int rc, match = 0;
 688                         const char *text;
 689                         const char *attr = b->a_dn_at->ad_cname.bv_val;
 690
 691                         assert( attr != NULL );
 692
 693 #ifdef NEW_LOGGING
 694                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 695                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 696                                    conn->c_connid, attr ));
 697 #else
 698                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n",
 699                                 attr, 0, 0);
 700 #endif
 701                         bv = op->o_ndn;
 702
 703                         /* see if asker is listed in dnattr */
 704                         for( at = attrs_find( e->e_attrs, b->a_dn_at );
 705                                 at != NULL;
 706                                 at = attrs_find( at->a_next, b->a_dn_at ) )
 707                         {
 708                                 if( value_find( b->a_dn_at, at->a_vals, &bv ) == 0 ) {
 709                                         /* found it */
 710                                         match = 1;
 711                                         break;
 712                                 }
 713                         }
 714
 715                         if( match ) {
 716                                 /* have a dnattr match. if this is a self clause then
 717                                  * the target must also match the op dn.
 718                                  */
 719                                 if ( b->a_dn_self ) {
 720                                         /* check if the target is an attribute. */
 721                                         if ( val == NULL )
 722                                                 continue;
 723                                         /* target is attribute, check if the attribute value
 724                                          * is the op dn.
 725                                          */
 726                                         rc = value_match( &match, b->a_dn_at,
 727                                                 b->a_dn_at->ad_type->sat_equality, 0,
 728                                                 val, &bv, &text );
 729                                         /* on match error or no match, fail the ACL clause */
 730                                         if (rc != LDAP_SUCCESS || match != 0 )
 731                                                 continue;
 732                                 }
 733                         } else {
 734                                 /* no dnattr match, check if this is a self clause */
 735                                 if ( ! b->a_dn_self )
 736                                         continue;
 737                                 /* this is a self clause, check if the target is an
 738                                  * attribute.
 739                                  */
 740                                 if ( val == NULL )
 741                                         continue;
 742                                 /* target is attribute, check if the attribute value
 743                                  * is the op dn.
 744                                  */
 745                                 rc = value_match( &match, b->a_dn_at,
 746                                         b->a_dn_at->ad_type->sat_equality, 0,
 747                                         val, &bv, &text );
 748
 749                                 /* on match error or no match, fail the ACL clause */
 750                                 if (rc != LDAP_SUCCESS || match != 0 )
 751                                         continue;
 752                         }
 753                 }
 754
 755                 if ( b->a_group_pat.bv_len && op->o_ndn.bv_len ) {
 756                         char buf[1024];
 757                         struct berval bv = { sizeof(buf) - 1, buf };
 758                         struct berval ndn = { 0, NULL };
 759                         int rc;
 760
 761                         /* b->a_group is an unexpanded entry name, expanded it should be an
 762                          * entry with objectclass group* and we test to see if odn is one of
 763                          * the values in the attribute group
 764                          */
 765                         /* see if asker is listed in dnattr */
 766                         if ( b->a_group_style == ACL_STYLE_REGEX ) {
 767                                 string_expand(&bv, b->a_group_pat.bv_val, e->e_ndn, matches);
 768                                 if ( dnNormalize2(NULL, &bv, &ndn) != LDAP_SUCCESS ) {
 769                                         /* did not expand to a valid dn */
 770                                         continue;
 771                                 }
 772                                 bv = ndn;
 773                         } else {
 774                                 bv = b->a_group_pat;
 775                         }
 776
 777                         rc = backend_group(be, conn, op, e, &bv, &op->o_ndn,
 778                                 b->a_group_oc, b->a_group_at);
 779                         if ( ndn.bv_val )
 780                                 free( ndn.bv_val );
 781                         if ( rc != 0 )
 782                         {
 783                                 continue;
 784                         }
 785                 }
 786
 787                 if ( b->a_set_pat.bv_len != 0 ) {
 788                         if (aci_match_set( &b->a_set_pat, be, e, conn, op, 0 ) == 0) {
 789                                 continue;
 790                         }
 791                 }
 792
 793                 if ( b->a_authz.sai_ssf ) {
 794 #ifdef NEW_LOGGING
 795                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 796                                    "acl_mask: conn %d  check a_authz.sai_ssf: ACL %u > OP %u\n",
 797                                    conn->c_connid, b->a_authz.sai_ssf, op->o_ssf ));
 798 #else
 799                         Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
 800                                 b->a_authz.sai_ssf, op->o_ssf, 0 );
 801 #endif
 802                         if ( b->a_authz.sai_ssf >  op->o_ssf ) {
 803                                 continue;
 804                         }
 805                 }
 806
 807                 if ( b->a_authz.sai_transport_ssf ) {
 808 #ifdef NEW_LOGGING
 809                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 810                                    "acl_mask: conn %d  check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 811                                    conn->c_connid, b->a_authz.sai_transport_ssf, op->o_transport_ssf ));
 812 #else
 813                         Debug( LDAP_DEBUG_ACL,
 814                                 "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 815                                 b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
 816 #endif
 817                         if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
 818                                 continue;
 819                         }
 820                 }
 821
 822                 if ( b->a_authz.sai_tls_ssf ) {
 823 #ifdef NEW_LOGGING
 824                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 825                                    "acl_mask: conn %d  check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 826                                    conn->c_connid, b->a_authz.sai_tls_ssf, op->o_tls_ssf ));
 827 #else
 828                         Debug( LDAP_DEBUG_ACL,
 829                                 "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 830                                 b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
 831 #endif
 832                         if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
 833                                 continue;
 834                         }
 835                 }
 836
 837                 if ( b->a_authz.sai_sasl_ssf ) {
 838 #ifdef NEW_LOGGING
 839                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 840                                    "acl_mask: conn %d check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 841                                    conn->c_connid, b->a_authz.sai_sasl_ssf, op->o_sasl_ssf ));
 842 #else
 843                         Debug( LDAP_DEBUG_ACL,
 844                                 "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 845                                 b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
 846 #endif
 847                         if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
 848                                 continue;
 849                         }
 850                 }
 851
 852 #ifdef SLAPD_ACI_ENABLED
 853                 if ( b->a_aci_at != NULL ) {
 854                         Attribute       *at;
 855                         slap_access_t grant, deny, tgrant, tdeny;
 856
 857                         /* this case works different from the others above.
 858                          * since aci's themselves give permissions, we need
 859                          * to first check b->a_access_mask, the ACL's access level.
 860                          */
 861
 862                         if ( e->e_nname.bv_len == 0 ) {
 863                                 /* no ACIs in the root DSE */
 864                                 continue;
 865                         }
 866
 867                         /* first check if the right being requested
 868                          * is allowed by the ACL clause.
 869                          */
 870                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
 871                                 continue;
 872                         }
 873
 874                         /* get the aci attribute */
 875                         at = attr_find( e->e_attrs, b->a_aci_at );
 876                         if ( at == NULL ) {
 877                                 continue;
 878                         }
 879
 880                         /* start out with nothing granted, nothing denied */
 881                         ACL_INIT(tgrant);
 882                         ACL_INIT(tdeny);
 883
 884                         /* the aci is an multi-valued attribute.  The
 885                          * rights are determined by OR'ing the individual
 886                          * rights given by the acis.
 887                          */
 888                         for ( i = 0; at->a_vals[i].bv_val != NULL; i++ ) {
 889                                 if (aci_mask( be, conn, op,
 890                                         e, desc, val, &at->a_vals[i],
 891                                         matches, &grant, &deny ) != 0)
 892                                 {
 893                                         tgrant |= grant;
 894                                         tdeny |= deny;
 895                                 }
 896                         }
 897
 898                         /* remove anything that the ACL clause does not allow */
 899                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
 900                         tdeny &= ACL_PRIV_MASK;
 901
 902                         /* see if we have anything to contribute */
 903                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
 904                                 continue;
 905                         }
 906
 907                         /* this could be improved by changing acl_mask so that it can deal with
 908                          * by clauses that return grant/deny pairs.  Right now, it does either
 909                          * additive or subtractive rights, but not both at the same time.  So,
 910                          * we need to combine the grant/deny pair into a single rights mask in
 911                          * a smart way:  if either grant or deny is "empty", then we use the
 912                          * opposite as is, otherwise we remove any denied rights from the grant
 913                          * rights mask and construct an additive mask.
 914                          */
 915                         if (ACL_IS_INVALID(tdeny)) {
 916                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
 917
 918                         } else if (ACL_IS_INVALID(tgrant)) {
 919                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
 920
 921                         } else {
 922                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
 923                         }
 924
 925                 } else
 926 #endif
 927                 {
 928                         modmask = b->a_access_mask;
 929                 }
 930
 931 #ifdef NEW_LOGGING
 932                 LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 933                            "acl_mask: conn %d  [%d] applying %s (%s)\n",
 934                            conn->c_connid, i, accessmask2str( modmask, accessmaskbuf),
 935                            b->a_type == ACL_CONTINUE ? "continue" : b->a_type == ACL_BREAK
 936                            ? "break" : "stop" ));
 937 #else
 938                 Debug( LDAP_DEBUG_ACL,
 939                         "<= acl_mask: [%d] applying %s (%s)\n",
 940                         i, accessmask2str( modmask, accessmaskbuf ),
 941                         b->a_type == ACL_CONTINUE
 942                                 ? "continue"
 943                                 : b->a_type == ACL_BREAK
 944                                         ? "break"
 945                                         : "stop" );
 946 #endif
 947                 /* save old mask */
 948                 oldmask = *mask;
 949
 950                 if( ACL_IS_ADDITIVE(modmask) ) {
 951                         /* add privs */
 952                         ACL_PRIV_SET( *mask, modmask );
 953
 954                         /* cleanup */
 955                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 956
 957                 } else if( ACL_IS_SUBTRACTIVE(modmask) ) {
 958                         /* substract privs */
 959                         ACL_PRIV_CLR( *mask, modmask );
 960
 961                         /* cleanup */
 962                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 963
 964                 } else {
 965                         /* assign privs */
 966                         *mask = modmask;
 967                 }
 968
 969 #ifdef NEW_LOGGING
 970                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
 971                            "acl_mask: conn %d  [%d] mask: %s\n",
 972                            conn->c_connid, i, accessmask2str( *mask, accessmaskbuf) ));
 973 #else
 974                 Debug( LDAP_DEBUG_ACL,
 975                         "<= acl_mask: [%d] mask: %s\n",
 976                         i, accessmask2str(*mask, accessmaskbuf), 0 );
 977 #endif
 978
 979                 if( b->a_type == ACL_CONTINUE ) {
 980                         continue;
 981
 982                 } else if ( b->a_type == ACL_BREAK ) {
 983                         return ACL_BREAK;
 984
 985                 } else {
 986                         return ACL_STOP;
 987                 }
 988         }
 989
 990         /* implicit "by * none" clause */
 991         ACL_INIT(*mask);
 992
 993 #ifdef NEW_LOGGING
 994         LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 995                    "acl_mask: conn %d  no more <who> clauses, returning %d (stop)\n",
 996                    conn->c_connid, accessmask2str( *mask, accessmaskbuf) ));
 997 #else
 998         Debug( LDAP_DEBUG_ACL,
 999                 "<= acl_mask: no more <who> clauses, returning %s (stop)\n",
1000                 accessmask2str(*mask, accessmaskbuf), 0, 0 );
1001 #endif
1002         return ACL_STOP;
1003 }
1004
1005 /*
1006  * acl_check_modlist - check access control on the given entry to see if
1007  * it allows the given modifications by the user associated with op.
1008  * returns      1       if mods allowed ok
1009  *                      0       mods not allowed
1010  */
1011
1012 int
1013 acl_check_modlist(
1014     Backend     *be,
1015     Connection  *conn,
1016     Operation   *op,
1017     Entry       *e,
1018     Modifications       *mlist
1019 )
1020 {
1021         struct berval *bv;
1022
1023         assert( be != NULL );
1024
1025         /* short circuit root database access */
1026         if ( be_isroot( be, &op->o_ndn ) ) {
1027 #ifdef NEW_LOGGING
1028                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
1029                            "acl_check_modlist: conn %d  access granted to root user\n",
1030                            conn->c_connid ));
1031 #else
1032                 Debug( LDAP_DEBUG_ACL,
1033                         "<= acl_access_allowed: granted to database root\n",
1034                     0, 0, 0 );
1035 #endif
1036                 return 1;
1037         }
1038
1039         /* use backend default access if no backend acls */
1040         if( be != NULL && be->be_acl == NULL ) {
1041 #ifdef NEW_LOGGING
1042                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1043                            "acl_check_modlist: conn %d  backend default %s access %s to \"%s\"\n",
1044                            conn->c_connid, access2str( ACL_WRITE ),
1045                            be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn.bv_val ));
1046 #else
1047                 Debug( LDAP_DEBUG_ACL,
1048                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
1049                         access2str( ACL_WRITE ),
1050                         be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn.bv_val );
1051 #endif
1052                 return be->be_dfltaccess >= ACL_WRITE;
1053
1054 #ifdef notdef
1055         /* be is always non-NULL */
1056         /* use global default access if no global acls */
1057         } else if ( be == NULL && global_acl == NULL ) {
1058 #ifdef NEW_LOGGING
1059                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1060                            "acl_check_modlist: conn %d  global default %s access %s to \"%s\"\n",
1061                            conn->c_connid, access2str( ACL_WRITE ),
1062                            global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn ));
1063 #else
1064                 Debug( LDAP_DEBUG_ACL,
1065                         "=> access_allowed: global default %s access %s to \"%s\"\n",
1066                         access2str( ACL_WRITE ),
1067                         global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn );
1068 #endif
1069                 return global_default_access >= ACL_WRITE;
1070 #endif
1071         }
1072
1073         for ( ; mlist != NULL; mlist = mlist->sml_next ) {
1074                 /*
1075                  * no-user-modification operational attributes are ignored
1076                  * by ACL_WRITE checking as any found here are not provided
1077                  * by the user
1078                  */
1079                 if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
1080 #ifdef NEW_LOGGING
1081                         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1082                                    "acl_check_modlist: conn %d  no-user-mod %s: modify access granted\n",
1083                                    conn->c_connid, mlist->sml_desc->ad_cname.bv_val ));
1084 #else
1085                         Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
1086                                 " modify access granted\n",
1087                                 mlist->sml_desc->ad_cname.bv_val, 0, 0 );
1088 #endif
1089                         continue;
1090                 }
1091
1092                 switch ( mlist->sml_op ) {
1093                 case LDAP_MOD_REPLACE:
1094                         if ( mlist->sml_bvalues == NULL ) {
1095                                 if ( ! access_allowed( be, conn, op, e,
1096                                         mlist->sml_desc, NULL, ACL_WRITE ) )
1097                                 {
1098                                         return( 0 );
1099                                 }
1100                                 break;
1101                         }
1102
1103                         /* fall thru */
1104
1105                 case LDAP_MOD_ADD:
1106                         assert( mlist->sml_bvalues != NULL );
1107
1108                         for ( bv = mlist->sml_bvalues; bv->bv_val != NULL; bv++ ) {
1109                                 if ( ! access_allowed( be, conn, op, e,
1110                                         mlist->sml_desc, bv, ACL_WRITE ) )
1111                                 {
1112                                         return( 0 );
1113                                 }
1114                         }
1115                         break;
1116
1117                 case LDAP_MOD_DELETE:
1118                         if ( mlist->sml_bvalues == NULL ) {
1119                                 if ( ! access_allowed( be, conn, op, e,
1120                                         mlist->sml_desc, NULL, ACL_WRITE ) )
1121                                 {
1122                                         return( 0 );
1123                                 }
1124                                 break;
1125                         }
1126                         for ( bv = mlist->sml_bvalues; bv->bv_val != NULL; bv++ ) {
1127                                 if ( ! access_allowed( be, conn, op, e,
1128                                         mlist->sml_desc, bv, ACL_WRITE ) )
1129                                 {
1130                                         return( 0 );
1131                                 }
1132                         }
1133                         break;
1134                 }
1135         }
1136
1137         return( 1 );
1138 }
1139
1140 static char *
1141 aci_bvstrdup( struct berval *bv )
1142 {
1143         char *s;
1144
1145         s = (char *)ch_malloc(bv->bv_len + 1);
1146         if (s != NULL) {
1147                 AC_MEMCPY(s, bv->bv_val, bv->bv_len);
1148                 s[bv->bv_len] = 0;
1149         }
1150         return(s);
1151 }
1152
1153 #ifdef SLAPD_ACI_ENABLED
1154 static int
1155 aci_strbvcmp(
1156         const char *s,
1157         struct berval *bv )
1158 {
1159         int res, len;
1160
1161         res = strncasecmp( s, bv->bv_val, bv->bv_len );
1162         if (res)
1163                 return(res);
1164         len = strlen(s);
1165         if (len > (int)bv->bv_len)
1166                 return(1);
1167         if (len < (int)bv->bv_len)
1168                 return(-1);
1169         return(0);
1170 }
1171 #endif
1172
1173 static int
1174 aci_get_part(
1175         struct berval *list,
1176         int ix,
1177         char sep,
1178         struct berval *bv )
1179 {
1180         int len;
1181         char *p;
1182
1183         if (bv) {
1184                 bv->bv_len = 0;
1185                 bv->bv_val = NULL;
1186         }
1187         len = list->bv_len;
1188         p = list->bv_val;
1189         while (len >= 0 && --ix >= 0) {
1190                 while (--len >= 0 && *p++ != sep) ;
1191         }
1192         while (len >= 0 && *p == ' ') {
1193                 len--;
1194                 p++;
1195         }
1196         if (len < 0)
1197                 return(-1);
1198
1199         if (!bv)
1200                 return(0);
1201
1202         bv->bv_val = p;
1203         while (--len >= 0 && *p != sep) {
1204                 bv->bv_len++;
1205                 p++;
1206         }
1207         while (bv->bv_len > 0 && *--p == ' ')
1208                 bv->bv_len--;
1209         return(bv->bv_len);
1210 }
1211
1212 BerVarray
1213 aci_set_gather (void *cookie, char *name, struct berval *attr)
1214 {
1215         AciSetCookie *cp = cookie;
1216         BerVarray bvals = NULL;
1217         struct berval bv, ndn;
1218
1219         /* this routine needs to return the bervals instead of
1220          * plain strings, since syntax is not known.  It should
1221          * also return the syntax or some "comparison cookie".
1222          */
1223
1224         bv.bv_val = name;
1225         bv.bv_len = strlen( name );
1226         if (dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS) {
1227                 const char *text;
1228                 AttributeDescription *desc = NULL;
1229                 if (slap_bv2ad(attr, &desc, &text) == LDAP_SUCCESS) {
1230                         backend_attribute(cp->be, NULL, NULL,
1231                                 cp->e, &ndn, desc, &bvals);
1232                 }
1233                 free(ndn.bv_val);
1234         }
1235         return(bvals);
1236 }
1237
1238 static int
1239 aci_match_set (
1240         struct berval *subj,
1241     Backend *be,
1242     Entry *e,
1243     Connection *conn,
1244     Operation *op,
1245     int setref
1246 )
1247 {
1248         struct berval set = { 0, NULL };
1249         int rc = 0;
1250         AciSetCookie cookie;
1251
1252         if (setref == 0) {
1253                 ber_dupbv( &set, subj );
1254         } else {
1255                 struct berval subjdn, ndn = { 0, NULL };
1256                 struct berval setat;
1257                 BerVarray bvals;
1258                 const char *text;
1259                 AttributeDescription *desc = NULL;
1260
1261                 /* format of string is "entry/setAttrName" */
1262                 if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
1263                         return(0);
1264                 } else {
1265                         /* FIXME: If dnNormalize was based on ldap_bv2dn
1266                          * instead of ldap_str2dn and would honor the bv_len
1267                          * we could skip this step and not worry about the
1268                          * unterminated string.
1269                          */
1270                         char *s = ch_malloc(subjdn.bv_len + 1);
1271                         AC_MEMCPY(s, subjdn.bv_val, subjdn.bv_len);
1272                         subjdn.bv_val = s;
1273                 }
1274
1275                 if ( aci_get_part(subj, 1, '/', &setat) < 0 ) {
1276                         setat.bv_val = SLAPD_ACI_SET_ATTR;
1277                         setat.bv_len = sizeof(SLAPD_ACI_SET_ATTR)-1;
1278                 }
1279                 if ( setat.bv_val != NULL ) {
1280                         if ( dnNormalize2(NULL, &subjdn, &ndn) == LDAP_SUCCESS
1281                                 && slap_bv2ad(&setat, &desc, &text) == LDAP_SUCCESS )
1282                         {
1283                                 backend_attribute(be, NULL, NULL, e,
1284                                         &ndn, desc, &bvals);
1285                                 if ( bvals != NULL ) {
1286                                         if ( bvals[0].bv_val != NULL ) {
1287                                                 int i;
1288                                                 set = bvals[0];
1289                                                 bvals[0].bv_val = NULL;
1290                                                 for (i=1;bvals[i].bv_val;i++);
1291                                                 bvals[0].bv_val = bvals[i-1].bv_val;
1292                                                 bvals[i-1].bv_val = NULL;
1293                                         }
1294                                         ber_bvarray_free(bvals);
1295                                 }
1296                         }
1297                         if (ndn.bv_val)
1298                                 free(ndn.bv_val);
1299                 }
1300                 ch_free(subjdn.bv_val);
1301         }
1302
1303         if (set.bv_val != NULL) {
1304                 cookie.be = be;
1305                 cookie.e = e;
1306                 cookie.conn = conn;
1307                 cookie.op = op;
1308                 rc = (slap_set_filter(aci_set_gather, &cookie, &set,
1309                         op->o_ndn.bv_val, e->e_ndn, NULL) > 0);
1310                 ch_free(set.bv_val);
1311         }
1312         return(rc);
1313 }
1314
1315 #ifdef SLAPD_ACI_ENABLED
1316 static int
1317 aci_list_map_rights(
1318         struct berval *list )
1319 {
1320         struct berval bv;
1321         slap_access_t mask;
1322         int i;
1323
1324         ACL_INIT(mask);
1325         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1326                 if (bv.bv_len <= 0)
1327                         continue;
1328                 switch (*bv.bv_val) {
1329                 case 'c':
1330                         ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
1331                         break;
1332                 case 's':
1333                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
1334                          * the right 's' to mean "set", but in the examples states
1335                          * that the right 's' means "search".  The latter definition
1336                          * is used here.
1337                          */
1338                         ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
1339                         break;
1340                 case 'r':
1341                         ACL_PRIV_SET(mask, ACL_PRIV_READ);
1342                         break;
1343                 case 'w':
1344                         ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
1345                         break;
1346                 case 'x':
1347                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
1348                          * define any equivalent to the AUTH right, so I've just used
1349                          * 'x' for now.
1350                          */
1351                         ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
1352                         break;
1353                 default:
1354                         break;
1355                 }
1356
1357         }
1358         return(mask);
1359 }
1360
1361 static int
1362 aci_list_has_attr(
1363         struct berval *list,
1364         const char *attr,
1365         struct berval *val )
1366 {
1367         struct berval bv, left, right;
1368         int i;
1369
1370         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1371                 if (aci_get_part(&bv, 0, '=', &left) < 0
1372                         || aci_get_part(&bv, 1, '=', &right) < 0)
1373                 {
1374                         if (aci_strbvcmp(attr, &bv) == 0)
1375                                 return(1);
1376                 } else if (val == NULL) {
1377                         if (aci_strbvcmp(attr, &left) == 0)
1378                                 return(1);
1379                 } else {
1380                         if (aci_strbvcmp(attr, &left) == 0) {
1381                                 /* this is experimental code that implements a
1382                                  * simple (prefix) match of the attribute value.
1383                                  * the ACI draft does not provide for aci's that
1384                                  * apply to specific values, but it would be
1385                                  * nice to have.  If the <attr> part of an aci's
1386                                  * rights list is of the form <attr>=<value>,
1387                                  * that means the aci applies only to attrs with
1388                                  * the given value.  Furthermore, if the attr is
1389                                  * of the form <attr>=<value>*, then <value> is
1390                                  * treated as a prefix, and the aci applies to
1391                                  * any value with that prefix.
1392                                  *
1393                                  * Ideally, this would allow r.e. matches.
1394                                  */
1395                                 if (aci_get_part(&right, 0, '*', &left) < 0
1396                                         || right.bv_len <= left.bv_len)
1397                                 {
1398                                         if (aci_strbvcmp(val->bv_val, &right) == 0)
1399                                                 return(1);
1400                                 } else if (val->bv_len >= left.bv_len) {
1401                                         if (strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0)
1402                                                 return(1);
1403                                 }
1404                         }
1405                 }
1406         }
1407         return(0);
1408 }
1409
1410 static slap_access_t
1411 aci_list_get_attr_rights(
1412         struct berval *list,
1413         const char *attr,
1414         struct berval *val )
1415 {
1416     struct berval bv;
1417     slap_access_t mask;
1418     int i;
1419
1420         /* loop through each rights/attr pair, skip first part (action) */
1421         ACL_INIT(mask);
1422         for (i = 1; aci_get_part(list, i + 1, ';', &bv) >= 0; i += 2) {
1423                 if (aci_list_has_attr(&bv, attr, val) == 0)
1424                         continue;
1425                 if (aci_get_part(list, i, ';', &bv) < 0)
1426                         continue;
1427                 mask |= aci_list_map_rights(&bv);
1428         }
1429         return(mask);
1430 }
1431
1432 static int
1433 aci_list_get_rights(
1434         struct berval *list,
1435         const char *attr,
1436         struct berval *val,
1437         slap_access_t *grant,
1438         slap_access_t *deny )
1439 {
1440     struct berval perm, actn;
1441     slap_access_t *mask;
1442     int i, found;
1443
1444         if (attr == NULL || *attr == 0 || strcasecmp(attr, "entry") == 0) {
1445                 attr = "[entry]";
1446         }
1447
1448         found = 0;
1449         ACL_INIT(*grant);
1450         ACL_INIT(*deny);
1451         /* loop through each permissions clause */
1452         for (i = 0; aci_get_part(list, i, '$', &perm) >= 0; i++) {
1453                 if (aci_get_part(&perm, 0, ';', &actn) < 0)
1454                         continue;
1455                 if (aci_strbvcmp( "grant", &actn ) == 0) {
1456                         mask = grant;
1457                 } else if (aci_strbvcmp( "deny", &actn ) == 0) {
1458                         mask = deny;
1459                 } else {
1460                         continue;
1461                 }
1462
1463                 found = 1;
1464                 *mask |= aci_list_get_attr_rights(&perm, attr, val);
1465                 *mask |= aci_list_get_attr_rights(&perm, "[all]", NULL);
1466         }
1467         return(found);
1468 }
1469
1470 static int
1471 aci_group_member (
1472         struct berval *subj,
1473         struct berval *defgrpoc,
1474         struct berval *defgrpat,
1475     Backend             *be,
1476     Entry               *e,
1477     Connection          *conn,
1478     Operation           *op,
1479         regmatch_t      *matches
1480 )
1481 {
1482         struct berval bv;
1483         char *subjdn;
1484         struct berval grpoc;
1485         struct berval grpat;
1486         ObjectClass *grp_oc = NULL;
1487         AttributeDescription *grp_ad = NULL;
1488         const char *text;
1489         int rc;
1490
1491         /* format of string is "group/objectClassValue/groupAttrName" */
1492         if (aci_get_part(subj, 0, '/', &bv) < 0) {
1493                 return(0);
1494         }
1495
1496         subjdn = aci_bvstrdup(&bv);
1497         if (subjdn == NULL) {
1498                 return(0);
1499         }
1500
1501         if (aci_get_part(subj, 1, '/', &grpoc) < 0) {
1502                 grpoc = *defgrpoc;
1503         }
1504
1505         if (aci_get_part(subj, 2, '/', &grpat) < 0) {
1506                 grpat = *defgrpat;
1507         }
1508
1509         rc = slap_bv2ad( &grpat, &grp_ad, &text );
1510         if( rc != LDAP_SUCCESS ) {
1511                 rc = 0;
1512                 goto done;
1513         }
1514         rc = 0;
1515
1516         grp_oc = oc_bvfind( &grpoc );
1517
1518         if (grp_oc != NULL && grp_ad != NULL ) {
1519                 struct berval ndn;
1520                 bv.bv_val = (char *)ch_malloc(1024);
1521                 bv.bv_len = 1024;
1522                 string_expand(&bv, subjdn, e->e_ndn, matches);
1523                 if ( dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS ) {
1524                         rc = (backend_group(be, conn, op, e, &ndn, &op->o_ndn, grp_oc, grp_ad) == 0);
1525                         free( ndn.bv_val );
1526                 }
1527                 ch_free(bv.bv_val);
1528         }
1529
1530 done:
1531         ch_free(subjdn);
1532         return(rc);
1533 }
1534
1535 static struct berval GroupClass = {
1536         sizeof(SLAPD_GROUP_CLASS)-1, SLAPD_GROUP_CLASS };
1537 static struct berval GroupAttr = {
1538         sizeof(SLAPD_GROUP_ATTR)-1, SLAPD_GROUP_ATTR };
1539 static struct berval RoleClass = {
1540         sizeof(SLAPD_ROLE_CLASS)-1, SLAPD_ROLE_CLASS };
1541 static struct berval RoleAttr = {
1542         sizeof(SLAPD_ROLE_ATTR)-1, SLAPD_ROLE_ATTR };
1543
1544 static int
1545 aci_mask(
1546     Backend                     *be,
1547     Connection          *conn,
1548     Operation           *op,
1549     Entry                       *e,
1550         AttributeDescription *desc,
1551     struct berval       *val,
1552     struct berval       *aci,
1553         regmatch_t              *matches,
1554         slap_access_t   *grant,
1555         slap_access_t   *deny
1556 )
1557 {
1558     struct berval bv, perms, sdn;
1559         int rc;
1560         char *attr = desc->ad_cname.bv_val;
1561
1562         assert( attr != NULL );
1563
1564         /* parse an aci of the form:
1565                 oid#scope#action;rights;attr;rights;attr$action;rights;attr;rights;attr#dnType#subjectDN
1566
1567            See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
1568            a full description of the format for this attribute.
1569
1570            For now, this routine only supports scope=entry.
1571          */
1572
1573         /* check that the aci has all 5 components */
1574         if (aci_get_part(aci, 4, '#', NULL) < 0)
1575                 return(0);
1576
1577         /* check that the aci family is supported */
1578         if (aci_get_part(aci, 0, '#', &bv) < 0)
1579                 return(0);
1580
1581         /* check that the scope is "entry" */
1582         if (aci_get_part(aci, 1, '#', &bv) < 0
1583                 || aci_strbvcmp( "entry", &bv ) != 0)
1584         {
1585                 return(0);
1586         }
1587
1588         /* get the list of permissions clauses, bail if empty */
1589         if (aci_get_part(aci, 2, '#', &perms) <= 0)
1590                 return(0);
1591
1592         /* check if any permissions allow desired access */
1593         if (aci_list_get_rights(&perms, attr, val, grant, deny) == 0)
1594                 return(0);
1595
1596         /* see if we have a DN match */
1597         if (aci_get_part(aci, 3, '#', &bv) < 0)
1598                 return(0);
1599
1600         if (aci_get_part(aci, 4, '#', &sdn) < 0)
1601                 return(0);
1602
1603         if (aci_strbvcmp( "access-id", &bv ) == 0) {
1604                 struct berval ndn;
1605                 rc = 1;
1606                 if ( dnNormalize2(NULL, &sdn, &ndn) == LDAP_SUCCESS ) {
1607                         if (strcasecmp(op->o_ndn.bv_val, ndn.bv_val) != 0)
1608                                 rc = 0;
1609                         free(ndn.bv_val);
1610                 }
1611                 return(rc);
1612         }
1613
1614         if (aci_strbvcmp( "self", &bv ) == 0) {
1615                 if (dn_match(&op->o_ndn, &e->e_nname))
1616                         return(1);
1617
1618         } else if (aci_strbvcmp( "dnattr", &bv ) == 0) {
1619                 char *dnattr = aci_bvstrdup(&sdn);
1620                 Attribute *at;
1621                 AttributeDescription *ad = NULL;
1622                 const char *text;
1623
1624                 rc = slap_str2ad( dnattr, &ad, &text );
1625                 ch_free( dnattr );
1626
1627                 if( rc != LDAP_SUCCESS ) {
1628                         return 0;
1629                 }
1630
1631                 rc = 0;
1632
1633                 bv = op->o_ndn;
1634
1635                 for(at = attrs_find( e->e_attrs, ad );
1636                         at != NULL;
1637                         at = attrs_find( at->a_next, ad ) )
1638                 {
1639                         if (value_find( ad, at->a_vals, &bv) == 0 ) {
1640                                 rc = 1;
1641                                 break;
1642                         }
1643                 }
1644
1645                 return rc;
1646
1647
1648         } else if (aci_strbvcmp( "group", &bv ) == 0) {
1649                 if (aci_group_member(&sdn, &GroupClass, &GroupAttr, be, e, conn, op, matches))
1650                         return(1);
1651
1652         } else if (aci_strbvcmp( "role", &bv ) == 0) {
1653                 if (aci_group_member(&sdn, &RoleClass, &RoleAttr, be, e, conn, op, matches))
1654                         return(1);
1655
1656         } else if (aci_strbvcmp( "set", &bv ) == 0) {
1657                 if (aci_match_set(&sdn, be, e, conn, op, 0))
1658                         return(1);
1659
1660         } else if (aci_strbvcmp( "set-ref", &bv ) == 0) {
1661                 if (aci_match_set(&sdn, be, e, conn, op, 1))
1662                         return(1);
1663
1664         }
1665
1666         return(0);
1667 }
1668
1669 #endif  /* SLAPD_ACI_ENABLED */
1670
1671 static void
1672 string_expand(
1673         struct berval *bv,
1674         char *pat,
1675         char *match,
1676         regmatch_t *matches)
1677 {
1678         ber_len_t       size;
1679         char   *sp;
1680         char   *dp;
1681         int     flag;
1682
1683         size = 0;
1684         bv->bv_val[0] = '\0';
1685         bv->bv_len--; /* leave space for lone $ */
1686
1687         flag = 0;
1688         for ( dp = bv->bv_val, sp = pat; size < bv->bv_len && *sp ; sp++) {
1689                 /* did we previously see a $ */
1690                 if (flag) {
1691                         if (*sp == '$') {
1692                                 *dp++ = '$';
1693                                 size++;
1694                         } else if (*sp >= '0' && *sp <= '9' ) {
1695                                 int     n;
1696                                 int     i;
1697                                 int     l;
1698
1699                                 n = *sp - '0';
1700                                 *dp = '\0';
1701                                 i = matches[n].rm_so;
1702                                 l = matches[n].rm_eo;
1703                                 for ( ; size < bv->bv_len && i < l; size++, i++ ) {
1704                                         *dp++ = match[i];
1705                                         size++;
1706                                 }
1707                                 *dp = '\0';
1708                         }
1709                         flag = 0;
1710                 } else {
1711                         if (*sp == '$') {
1712                                 flag = 1;
1713                         } else {
1714                                 *dp++ = *sp;
1715                                 size++;
1716                         }
1717                 }
1718         }
1719
1720         if (flag) {
1721                 /* must have ended with a single $ */
1722                 *dp++ = '$';
1723                 size++;
1724         }
1725
1726         *dp = '\0';
1727         bv->bv_len = size;
1728
1729 #ifdef NEW_LOGGING
1730         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1731                    "string_expand:  pattern = %s\n", pat ));
1732         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1733                    "string_expand:  expanded = %s\n", bv->bv_val ));
1734 #else
1735         Debug( LDAP_DEBUG_TRACE, "=> string_expand: pattern:  %s\n", pat, 0, 0 );
1736         Debug( LDAP_DEBUG_TRACE, "=> string_expand: expanded: %s\n", bv->bv_val, 0, 0 );
1737 #endif
1738 }
1739
1740 static int
1741 regex_matches(
1742         char *pat,                              /* pattern to expand and match against */
1743         char *str,                              /* string to match against pattern */
1744         char *buf,                              /* buffer with $N expansion variables */
1745         regmatch_t *matches             /* offsets in buffer for $N expansion variables */
1746 )
1747 {
1748         regex_t re;
1749         char newbuf[512];
1750         struct berval bv = {sizeof(newbuf), newbuf};
1751         int     rc;
1752
1753         if(str == NULL) str = "";
1754
1755         string_expand(&bv, pat, buf, matches);
1756         if (( rc = regcomp(&re, newbuf, REG_EXTENDED|REG_ICASE))) {
1757                 char error[512];
1758                 regerror(rc, &re, error, sizeof(error));
1759
1760 #ifdef NEW_LOGGING
1761                 LDAP_LOG(( "aci", LDAP_LEVEL_ERR,
1762                            "regex_matches: compile( \"%s\", \"%s\") failed %s\n",
1763                            pat, str, error ));
1764 #else
1765                 Debug( LDAP_DEBUG_TRACE,
1766                     "compile( \"%s\", \"%s\") failed %s\n",
1767                         pat, str, error );
1768 #endif
1769                 return( 0 );
1770         }
1771
1772         rc = regexec(&re, str, 0, NULL, 0);
1773         regfree( &re );
1774
1775 #ifdef NEW_LOGGING
1776         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1777                    "regex_matches: string:   %s\n", str ));
1778         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1779                    "regex_matches: rc:  %d  %s\n",
1780                    rc, rc ? "matches" : "no matches" ));
1781 #else
1782         Debug( LDAP_DEBUG_TRACE,
1783             "=> regex_matches: string:   %s\n", str, 0, 0 );
1784         Debug( LDAP_DEBUG_TRACE,
1785             "=> regex_matches: rc: %d %s\n",
1786                 rc, !rc ? "matches" : "no matches", 0 );
1787 #endif
1788         return( !rc );
1789 }
1790