git.sur5r.net Git - openldap/blob - servers/slapd/acl.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/regex.h>
  13 #include <ac/socket.h>
  14 #include <ac/string.h>
  15
  16 #include "slap.h"
  17 #include "sets.h"
  18
  19 static AccessControl * acl_get(
  20         AccessControl *ac, int *count,
  21         Backend *be, Operation *op,
  22         Entry *e,
  23         AttributeDescription *desc,
  24         int nmatches, regmatch_t *matches );
  25
  26 static slap_control_t acl_mask(
  27         AccessControl *ac, slap_mask_t *mask,
  28         Backend *be, Connection *conn, Operation *op,
  29         Entry *e,
  30         AttributeDescription *desc,
  31         struct berval *val,
  32         regmatch_t *matches );
  33
  34 #ifdef SLAPD_ACI_ENABLED
  35 static int aci_mask(
  36         Backend *be,
  37     Connection *conn,
  38         Operation *op,
  39         Entry *e,
  40         AttributeDescription *desc,
  41         struct berval *val,
  42         struct berval *aci,
  43         regmatch_t *matches,
  44         slap_access_t *grant,
  45         slap_access_t *deny );
  46 #endif
  47
  48 static int      regex_matches(
  49         char *pat, char *str, char *buf, regmatch_t *matches);
  50 static void     string_expand(
  51         struct berval *newbuf, char *pattern,
  52         char *match, regmatch_t *matches);
  53
  54 typedef struct AciSetCookie {
  55         Backend *be;
  56         Entry *e;
  57         Connection *conn;
  58         Operation *op;
  59 } AciSetCookie;
  60
  61 BerVarray aci_set_gather (void *cookie, char *name, struct berval *attr);
  62 static int aci_match_set ( struct berval *subj, Backend *be,
  63     Entry *e, Connection *conn, Operation *op, int setref );
  64
  65 /*
  66  * access_allowed - check whether op->o_ndn is allowed the requested access
  67  * to entry e, attribute attr, value val.  if val is null, access to
  68  * the whole attribute is assumed (all values).
  69  *
  70  * This routine loops through all access controls and calls
  71  * acl_mask() on each applicable access control.
  72  * The loop exits when a definitive answer is reached or
  73  * or no more controls remain.
  74  *
  75  * returns:
  76  *              0       access denied
  77  *              1       access granted
  78  */
  79
  80 int
  81 access_allowed(
  82     Backend             *be,
  83     Connection          *conn,
  84     Operation           *op,
  85     Entry               *e,
  86         AttributeDescription    *desc,
  87     struct berval       *val,
  88     slap_access_t       access )
  89 {
  90         int                             count;
  91         AccessControl   *a;
  92 #ifdef LDAP_DEBUG
  93         char accessmaskbuf[ACCESSMASK_MAXLEN];
  94 #endif
  95         slap_mask_t mask;
  96         slap_control_t control;
  97         const char *attr;
  98         regmatch_t matches[MAXREMATCHES];
  99
 100         assert( e != NULL );
 101         assert( desc != NULL );
 102         assert( access > ACL_NONE );
 103
 104         attr = desc->ad_cname.bv_val;
 105
 106         assert( attr != NULL );
 107
 108 #ifdef NEW_LOGGING
 109         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 110                 "access_allowed: conn %d %s access to \"%s\" \"%s\" requested\n",
 111                 conn ? conn->c_connid : -1, access2str( access ), e->e_dn, attr ));
 112 #else
 113         Debug( LDAP_DEBUG_ACL,
 114                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 115             access2str( access ), e->e_dn, attr );
 116 #endif
 117
 118         if ( op == NULL ) {
 119                 /* no-op call */
 120                 return 1;
 121         }
 122
 123         if ( be == NULL ) be = &backends[0];
 124         assert( be != NULL );
 125
 126         /* grant database root access */
 127         if ( be != NULL && be_isroot( be, &op->o_ndn ) ) {
 128 #ifdef NEW_LOGGING
 129                 LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
 130                        "access_allowed: conn %d root access granted\n",
 131                        conn->c_connid));
 132 #else
 133                 Debug( LDAP_DEBUG_ACL,
 134                     "<= root access granted\n",
 135                         0, 0, 0 );
 136 #endif
 137                 return 1;
 138         }
 139
 140         /*
 141          * no-user-modification operational attributes are ignored
 142          * by ACL_WRITE checking as any found here are not provided
 143          * by the user
 144          */
 145         if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 146                 && desc != slap_schema.si_ad_entry
 147                 && desc != slap_schema.si_ad_children )
 148         {
 149 #ifdef NEW_LOGGING
 150                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 151                        "access_allowed: conn %d NoUserMod Operational attribute: %s access granted\n",
 152                        conn->c_connid, attr ));
 153 #else
 154                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 155                         " %s access granted\n",
 156                         attr, 0, 0 );
 157 #endif
 158                 return 1;
 159         }
 160
 161         /* use backend default access if no backend acls */
 162         if( be != NULL && be->be_acl == NULL ) {
 163 #ifdef NEW_LOGGING
 164                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 165                        "access_allowed: conn %d backend default %s access %s to \"%s\"\n",
 166                        conn->c_connid, access2str( access ),
 167                        be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val ));
 168 #else
 169                 Debug( LDAP_DEBUG_ACL,
 170                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
 171                         access2str( access ),
 172                         be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val );
 173 #endif
 174                 return be->be_dfltaccess >= access;
 175
 176 #ifdef notdef
 177         /* be is always non-NULL */
 178         /* use global default access if no global acls */
 179         } else if ( be == NULL && global_acl == NULL ) {
 180 #ifdef NEW_LOGGING
 181                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 182                        "access_allowed: conn %d global default %s access %s to \"%s\"\n",
 183                        conn->c_connid, access2str( access ),
 184                        global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val ));
 185 #else
 186                 Debug( LDAP_DEBUG_ACL,
 187                         "=> access_allowed: global default %s access %s to \"%s\"\n",
 188                         access2str( access ),
 189                         global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val );
 190 #endif
 191                 return global_default_access >= access;
 192 #endif
 193         }
 194
 195         ACL_INIT(mask);
 196         memset(matches, '\0', sizeof(matches));
 197
 198         control = ACL_BREAK;
 199         a = NULL;
 200         count = 0;
 201
 202         while((a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches )) != NULL)
 203         {
 204                 int i;
 205
 206                 for (i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++) {
 207 #ifdef NEW_LOGGING
 208                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 209                                "access_allowed: conn %d match[%d]:  %d %d ",
 210                                conn->c_connid, i, (int)matches[i].rm_so, (int)matches[i].rm_eo ));
 211 #else
 212                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 213                                (int)matches[i].rm_so, (int)matches[i].rm_eo );
 214 #endif
 215                         if( matches[i].rm_so <= matches[0].rm_eo ) {
 216                                 int n;
 217                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++) {
 218                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 219                                 }
 220                         }
 221 #ifdef NEW_LOGGING
 222                         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS, "\n" ));
 223 #else
 224                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 225 #endif
 226                 }
 227
 228                 control = acl_mask( a, &mask, be, conn, op,
 229                         e, desc, val, matches );
 230
 231                 if ( control != ACL_BREAK ) {
 232                         break;
 233                 }
 234
 235                 memset(matches, '\0', sizeof(matches));
 236         }
 237
 238         if ( ACL_IS_INVALID( mask ) ) {
 239 #ifdef NEW_LOGGING
 240                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 241                        "access_allowed: conn %d  \"%s\" (%s) invalid!\n",
 242                        conn->c_connid, e->e_dn, attr ));
 243 #else
 244                 Debug( LDAP_DEBUG_ACL,
 245                         "=> access_allowed: \"%s\" (%s) invalid!\n",
 246                         e->e_dn, attr, 0 );
 247 #endif
 248                 ACL_INIT( mask );
 249
 250         } else if ( control == ACL_BREAK ) {
 251 #ifdef NEW_LOGGING
 252                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 253                        "access_allowed: conn %d  no more rules\n", conn->c_connid ));
 254 #else
 255                 Debug( LDAP_DEBUG_ACL,
 256                         "=> access_allowed: no more rules\n", 0, 0, 0);
 257 #endif
 258                 ACL_INIT( mask );
 259         }
 260
 261 #ifdef NEW_LOGGING
 262         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 263                    "access_allowed: conn %d  %s access %s by %s\n",
 264                    conn->c_connid,
 265                    access2str( access ),
 266                    ACL_GRANT( mask, access ) ? "granted" : "denied",
 267                    accessmask2str( mask, accessmaskbuf ) ));
 268 #else
 269         Debug( LDAP_DEBUG_ACL,
 270                 "=> access_allowed: %s access %s by %s\n",
 271                 access2str( access ),
 272                 ACL_GRANT(mask, access) ? "granted" : "denied",
 273                 accessmask2str( mask, accessmaskbuf ) );
 274 #endif
 275         return ACL_GRANT(mask, access);
 276 }
 277
 278 /*
 279  * acl_get - return the acl applicable to entry e, attribute
 280  * attr.  the acl returned is suitable for use in subsequent calls to
 281  * acl_access_allowed().
 282  */
 283
 284 static AccessControl *
 285 acl_get(
 286         AccessControl *a,
 287         int                     *count,
 288     Backend             *be,
 289     Operation   *op,
 290     Entry               *e,
 291         AttributeDescription *desc,
 292     int                 nmatch,
 293     regmatch_t  *matches )
 294 {
 295         const char *attr;
 296         int dnlen, patlen;
 297
 298         assert( e != NULL );
 299         assert( count != NULL );
 300         assert( desc != NULL );
 301
 302         attr = desc->ad_cname.bv_val;
 303
 304         assert( attr != NULL );
 305
 306         if( a == NULL ) {
 307                 if( be == NULL ) {
 308                         a = global_acl;
 309                 } else {
 310                         a = be->be_acl;
 311                 }
 312
 313                 assert( a != NULL );
 314
 315         } else {
 316                 a = a->acl_next;
 317         }
 318
 319         dnlen = e->e_nname.bv_len;
 320
 321         for ( ; a != NULL; a = a->acl_next ) {
 322                 (*count) ++;
 323
 324                 if (a->acl_dn_pat.bv_len != 0) {
 325                         if ( a->acl_dn_style == ACL_STYLE_REGEX ) {
 326 #ifdef NEW_LOGGING
 327                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 328                                            "acl_get: dnpat [%d] %s nsub: %d\n",
 329                                            *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub ));
 330 #else
 331                                 Debug( LDAP_DEBUG_ACL, "=> dnpat: [%d] %s nsub: %d\n",
 332                                         *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub );
 333 #endif
 334                                 if (regexec(&a->acl_dn_re, e->e_ndn, nmatch, matches, 0))
 335                                         continue;
 336
 337                         } else {
 338 #ifdef NEW_LOGGING
 339                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 340                                            "acl_get: dn [%d] %s\n",
 341                                            *count, a->acl_dn_pat.bv_val ));
 342 #else
 343                                 Debug( LDAP_DEBUG_ACL, "=> dn: [%d] %s\n",
 344                                         *count, a->acl_dn_pat.bv_val, 0 );
 345 #endif
 346                                 patlen = a->acl_dn_pat.bv_len;
 347                                 if ( dnlen < patlen )
 348                                         continue;
 349
 350                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 351                                         /* base dn -- entire object DN must match */
 352                                         if ( dnlen != patlen )
 353                                                 continue;
 354
 355                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 356                                         int rdnlen = -1;
 357
 358                                         if ( dnlen <= patlen )
 359                                                 continue;
 360
 361                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 362                                                 continue;
 363
 364                                         rdnlen = dn_rdnlen( NULL, &e->e_nname );
 365                                         if ( rdnlen != dnlen - patlen - 1 )
 366                                                 continue;
 367
 368                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 369                                         if ( dnlen > patlen && ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) ) )
 370                                                 continue;
 371
 372                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 373                                         if ( dnlen <= patlen )
 374                                                 continue;
 375                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 376                                                 continue;
 377                                 }
 378
 379                                 if ( strcmp( a->acl_dn_pat.bv_val, e->e_ndn + dnlen - patlen ) != 0 )
 380                                         continue;
 381                         }
 382
 383 #ifdef NEW_LOGGING
 384                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 385                                    "acl_get: [%d] matched\n",
 386                                    *count ));
 387 #else
 388                         Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] matched\n",
 389                                 *count, 0, 0 );
 390 #endif
 391                 }
 392
 393                 if ( a->acl_filter != NULL ) {
 394                         ber_int_t rc = test_filter( NULL, NULL, NULL, e, a->acl_filter );
 395                         if ( rc != LDAP_COMPARE_TRUE ) {
 396                                 continue;
 397                         }
 398                 }
 399
 400 #ifdef NEW_LOGGING
 401                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 402                            "acl_get: [%d] check attr %s\n",
 403                            *count, attr ));
 404 #else
 405                 Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] check attr %s\n",
 406                        *count, attr, 0);
 407 #endif
 408                 if ( attr == NULL || a->acl_attrs == NULL ||
 409                         ad_inlist( desc, a->acl_attrs ) )
 410                 {
 411 #ifdef NEW_LOGGING
 412                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 413                                    "acl_get:  [%d] acl %s attr: %s\n",
 414                                    *count, e->e_dn, attr ));
 415 #else
 416                         Debug( LDAP_DEBUG_ACL,
 417                                 "<= acl_get: [%d] acl %s attr: %s\n",
 418                                 *count, e->e_dn, attr );
 419 #endif
 420                         return a;
 421                 }
 422                 matches[0].rm_so = matches[0].rm_eo = -1;
 423         }
 424
 425 #ifdef NEW_LOGGING
 426         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 427                    "acl_get: done.\n" ));
 428 #else
 429         Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
 430 #endif
 431         return( NULL );
 432 }
 433
 434
 435 /*
 436  * acl_mask - modifies mask based upon the given acl and the
 437  * requested access to entry e, attribute attr, value val.  if val
 438  * is null, access to the whole attribute is assumed (all values).
 439  *
 440  * returns      0       access NOT allowed
 441  *              1       access allowed
 442  */
 443
 444 static slap_control_t
 445 acl_mask(
 446     AccessControl       *a,
 447         slap_mask_t *mask,
 448     Backend             *be,
 449     Connection  *conn,
 450     Operation   *op,
 451     Entry               *e,
 452         AttributeDescription *desc,
 453     struct berval       *val,
 454         regmatch_t      *matches
 455 )
 456 {
 457         int             i, odnlen, patlen;
 458         Access  *b;
 459 #ifdef LDAP_DEBUG
 460         char accessmaskbuf[ACCESSMASK_MAXLEN];
 461 #endif
 462         const char *attr;
 463
 464         assert( a != NULL );
 465         assert( mask != NULL );
 466         assert( desc != NULL );
 467
 468         attr = desc->ad_cname.bv_val;
 469
 470         assert( attr != NULL );
 471
 472 #ifdef NEW_LOGGING
 473         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 474                    "acl_mask: conn %d  access to entry \"%s\", attr \"%s\" requested\n",
 475                    conn->c_connid, e->e_dn, attr ));
 476
 477         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS,
 478                    " to %s by \"%s\", (%s) \n",
 479                    val ? "value" : "all values",
 480                    op->o_ndn.bv_val ? op->o_ndn.bv_val : "",
 481                    accessmask2str( *mask, accessmaskbuf ) ));
 482 #else
 483         Debug( LDAP_DEBUG_ACL,
 484                 "=> acl_mask: access to entry \"%s\", attr \"%s\" requested\n",
 485                 e->e_dn, attr, 0 );
 486
 487         Debug( LDAP_DEBUG_ACL,
 488                 "=> acl_mask: to %s by \"%s\", (%s) \n",
 489                 val ? "value" : "all values",
 490                 op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
 491                 accessmask2str( *mask, accessmaskbuf ) );
 492 #endif
 493
 494         for ( i = 1, b = a->acl_access; b != NULL; b = b->a_next, i++ ) {
 495                 slap_mask_t oldmask, modmask;
 496
 497                 ACL_INVALIDATE( modmask );
 498
 499                 /* AND <who> clauses */
 500                 if ( b->a_dn_pat.bv_len != 0 ) {
 501 #ifdef NEW_LOGGING
 502                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 503                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 504                                    conn->c_connid, b->a_dn_pat.bv_val ));
 505 #else
 506                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
 507                                 b->a_dn_pat.bv_val, 0, 0);
 508 #endif
 509                         /*
 510                          * if access applies to the entry itself, and the
 511                          * user is bound as somebody in the same namespace as
 512                          * the entry, OR the given dn matches the dn pattern
 513                          */
 514                         if ( b->a_dn_pat.bv_len == sizeof("anonymous") -1 &&
 515                             strcmp( b->a_dn_pat.bv_val, "anonymous" ) == 0 ) {
 516                                 if (op->o_ndn.bv_len != 0 ) {
 517                                         continue;
 518                                 }
 519
 520                         } else if ( b->a_dn_pat.bv_len == sizeof("users") - 1 &&
 521                             strcmp( b->a_dn_pat.bv_val, "users" ) == 0 ) {
 522                                 if (op->o_ndn.bv_len == 0 ) {
 523                                         continue;
 524                                 }
 525
 526                         } else if ( b->a_dn_pat.bv_len == sizeof("self") - 1 &&
 527                             strcmp( b->a_dn_pat.bv_val, "self" ) == 0 ) {
 528                                 if( op->o_ndn.bv_len == 0 ) {
 529                                         continue;
 530                                 }
 531
 532                                 if ( e->e_dn == NULL || strcmp( e->e_ndn, op->o_ndn.bv_val ) != 0 ) {
 533                                         continue;
 534                                 }
 535
 536                         } else if ( b->a_dn_style == ACL_STYLE_REGEX ) {
 537                                 if ( b->a_dn_pat.bv_len != 1 ||
 538                                     strcmp( b->a_dn_pat.bv_val, "*" ) != 0 ) {
 539                                         int ret = regex_matches( b->a_dn_pat.bv_val,
 540                                                 op->o_ndn.bv_val, e->e_ndn, matches );
 541
 542                                         if( ret == 0 ) {
 543                                                 continue;
 544                                         }
 545                                 }
 546
 547                         } else {
 548                                 if ( e->e_dn == NULL )
 549                                         continue;
 550
 551                                 patlen = b->a_dn_pat.bv_len;
 552                                 odnlen = op->o_ndn.bv_len;
 553                                 if ( odnlen < patlen )
 554                                         continue;
 555
 556                                 if ( b->a_dn_style == ACL_STYLE_BASE ) {
 557                                         /* base dn -- entire object DN must match */
 558                                         if ( odnlen != patlen )
 559                                                 continue;
 560
 561                                 } else if ( b->a_dn_style == ACL_STYLE_ONE ) {
 562                                         int rdnlen = -1;
 563
 564                                         if ( odnlen <= patlen )
 565                                                 continue;
 566
 567                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 568                                                 continue;
 569
 570                                         rdnlen = dn_rdnlen( NULL, &op->o_ndn );
 571                                         if ( rdnlen != odnlen - patlen - 1 )
 572                                                 continue;
 573
 574                                 } else if ( b->a_dn_style == ACL_STYLE_SUBTREE ) {
 575                                         if ( odnlen > patlen && ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) ) )
 576                                                 continue;
 577
 578                                 } else if ( b->a_dn_style == ACL_STYLE_CHILDREN ) {
 579                                         if ( odnlen <= patlen )
 580                                                 continue;
 581                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 582                                                 continue;
 583                                 }
 584
 585                                 if ( strcmp( b->a_dn_pat.bv_val, op->o_ndn.bv_val + odnlen - patlen ) != 0 )
 586                                         continue;
 587
 588                         }
 589                 }
 590
 591                 if ( b->a_sockurl_pat != NULL ) {
 592 #ifdef NEW_LOGGING
 593                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 594                                    "acl_mask: conn %d  check a_sockurl_pat: %s\n",
 595                                    conn->c_connid, b->a_sockurl_pat ));
 596 #else
 597                         Debug( LDAP_DEBUG_ACL, "<= check a_sockurl_pat: %s\n",
 598                                 b->a_sockurl_pat, 0, 0 );
 599 #endif
 600
 601                         if ( strcmp( b->a_sockurl_pat, "*" ) != 0) {
 602                                 if ( b->a_sockurl_style == ACL_STYLE_REGEX) {
 603                                         if (!regex_matches( b->a_sockurl_pat, conn->c_listener_url,
 604                                                         e->e_ndn, matches ) )
 605                                         {
 606                                                 continue;
 607                                         }
 608                                 } else {
 609                                         if ( strcasecmp( b->a_sockurl_pat, conn->c_listener_url ) != 0 )
 610                                                 continue;
 611                                 }
 612                         }
 613                 }
 614
 615                 if ( b->a_domain_pat != NULL ) {
 616 #ifdef NEW_LOGGING
 617                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 618                                    "acl_mask: conn %d  check a_domain_pat: %s\n",
 619                                    conn->c_connid, b->a_domain_pat ));
 620 #else
 621                         Debug( LDAP_DEBUG_ACL, "<= check a_domain_pat: %s\n",
 622                                 b->a_domain_pat, 0, 0 );
 623 #endif
 624                         if ( strcmp( b->a_domain_pat, "*" ) != 0) {
 625                                 if ( b->a_domain_style == ACL_STYLE_REGEX) {
 626                                         if (!regex_matches( b->a_domain_pat, conn->c_peer_domain,
 627                                                         e->e_ndn, matches ) )
 628                                         {
 629                                                 continue;
 630                                         }
 631                                 } else {
 632                                         if ( strcasecmp( b->a_domain_pat, conn->c_peer_domain ) != 0 )
 633                                                 continue;
 634                                 }
 635                         }
 636                 }
 637
 638                 if ( b->a_peername_pat != NULL ) {
 639 #ifdef NEW_LOGGING
 640                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 641                                    "acl_mask: conn %d  check a_perrname_path: %s\n",
 642                                    conn->c_connid, b->a_peername_pat ));
 643 #else
 644                         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
 645                                 b->a_peername_pat, 0, 0 );
 646 #endif
 647                         if ( strcmp( b->a_peername_pat, "*" ) != 0) {
 648                                 if ( b->a_peername_style == ACL_STYLE_REGEX) {
 649                                         if (!regex_matches( b->a_peername_pat, conn->c_peer_name,
 650                                                         e->e_ndn, matches ) )
 651                                         {
 652                                                 continue;
 653                                         }
 654                                 } else {
 655                                         if ( strcasecmp( b->a_peername_pat, conn->c_peer_name ) != 0 )
 656                                                 continue;
 657                                 }
 658                         }
 659                 }
 660
 661                 if ( b->a_sockname_pat != NULL ) {
 662 #ifdef NEW_LOGGING
 663                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 664                                    "acl_mask: conn %d  check a_sockname_path: %s\n",
 665                                    conn->c_connid, b->a_sockname_pat ));
 666 #else
 667                         Debug( LDAP_DEBUG_ACL, "<= check a_sockname_path: %s\n",
 668                                 b->a_sockname_pat, 0, 0 );
 669 #endif
 670                         if ( strcmp( b->a_sockname_pat, "*" ) != 0) {
 671                                 if ( b->a_sockname_style == ACL_STYLE_REGEX) {
 672                                         if (!regex_matches( b->a_sockname_pat, conn->c_sock_name,
 673                                                         e->e_ndn, matches ) )
 674                                         {
 675                                                 continue;
 676                                         }
 677                                 } else {
 678                                         if ( strcasecmp( b->a_sockname_pat, conn->c_sock_name ) != 0 )
 679                                                 continue;
 680                                 }
 681                         }
 682                 }
 683
 684                 if ( b->a_dn_at != NULL && op->o_ndn.bv_len != 0 ) {
 685                         Attribute       *at;
 686                         struct berval   bv;
 687                         int rc, match = 0;
 688                         const char *text;
 689                         const char *attr = b->a_dn_at->ad_cname.bv_val;
 690
 691                         assert( attr != NULL );
 692
 693 #ifdef NEW_LOGGING
 694                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 695                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 696                                    conn->c_connid, attr ));
 697 #else
 698                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n",
 699                                 attr, 0, 0);
 700 #endif
 701                         bv = op->o_ndn;
 702
 703                         /* see if asker is listed in dnattr */
 704                         for( at = attrs_find( e->e_attrs, b->a_dn_at );
 705                                 at != NULL;
 706                                 at = attrs_find( at->a_next, b->a_dn_at ) )
 707                         {
 708                                 if( value_find( b->a_dn_at, at->a_vals, &bv ) == 0 ) {
 709                                         /* found it */
 710                                         match = 1;
 711                                         break;
 712                                 }
 713                         }
 714
 715                         if( match ) {
 716                                 /* have a dnattr match. if this is a self clause then
 717                                  * the target must also match the op dn.
 718                                  */
 719                                 if ( b->a_dn_self ) {
 720                                         /* check if the target is an attribute. */
 721                                         if ( val == NULL )
 722                                                 continue;
 723                                         /* target is attribute, check if the attribute value
 724                                          * is the op dn.
 725                                          */
 726                                         rc = value_match( &match, b->a_dn_at,
 727                                                 b->a_dn_at->ad_type->sat_equality, 0,
 728                                                 val, &bv, &text );
 729                                         /* on match error or no match, fail the ACL clause */
 730                                         if (rc != LDAP_SUCCESS || match != 0 )
 731                                                 continue;
 732                                 }
 733                         } else {
 734                                 /* no dnattr match, check if this is a self clause */
 735                                 if ( ! b->a_dn_self )
 736                                         continue;
 737                                 /* this is a self clause, check if the target is an
 738                                  * attribute.
 739                                  */
 740                                 if ( val == NULL )
 741                                         continue;
 742                                 /* target is attribute, check if the attribute value
 743                                  * is the op dn.
 744                                  */
 745                                 rc = value_match( &match, b->a_dn_at,
 746                                         b->a_dn_at->ad_type->sat_equality, 0,
 747                                         val, &bv, &text );
 748
 749                                 /* on match error or no match, fail the ACL clause */
 750                                 if (rc != LDAP_SUCCESS || match != 0 )
 751                                         continue;
 752                         }
 753                 }
 754
 755                 if ( b->a_group_pat.bv_len && op->o_ndn.bv_len ) {
 756                         char buf[1024];
 757                         struct berval bv = { sizeof(buf) - 1, buf };
 758                         struct berval ndn = { 0, NULL };
 759                         int rc;
 760
 761                         /* b->a_group is an unexpanded entry name, expanded it should be an
 762                          * entry with objectclass group* and we test to see if odn is one of
 763                          * the values in the attribute group
 764                          */
 765                         /* see if asker is listed in dnattr */
 766                         if ( b->a_group_style == ACL_STYLE_REGEX ) {
 767                                 string_expand(&bv, b->a_group_pat.bv_val, e->e_ndn, matches);
 768                                 if ( dnNormalize2(NULL, &bv, &ndn) != LDAP_SUCCESS ) {
 769                                         /* did not expand to a valid dn */
 770                                         continue;
 771                                 }
 772                                 bv = ndn;
 773                         } else {
 774                                 bv = b->a_group_pat;
 775                         }
 776
 777                         rc = backend_group(be, conn, op, e, &bv, &op->o_ndn,
 778                                 b->a_group_oc, b->a_group_at);
 779                         if ( ndn.bv_val )
 780                                 free( ndn.bv_val );
 781                         if ( rc != 0 )
 782                         {
 783                                 continue;
 784                         }
 785                 }
 786
 787                 if ( b->a_set_pat.bv_len != 0 ) {
 788                         if (aci_match_set( &b->a_set_pat, be, e, conn, op, 0 ) == 0) {
 789                                 continue;
 790                         }
 791                 }
 792
 793                 if ( b->a_authz.sai_ssf ) {
 794 #ifdef NEW_LOGGING
 795                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 796                                    "acl_mask: conn %d  check a_authz.sai_ssf: ACL %u > OP %u\n",
 797                                    conn->c_connid, b->a_authz.sai_ssf, op->o_ssf ));
 798 #else
 799                         Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
 800                                 b->a_authz.sai_ssf, op->o_ssf, 0 );
 801 #endif
 802                         if ( b->a_authz.sai_ssf >  op->o_ssf ) {
 803                                 continue;
 804                         }
 805                 }
 806
 807                 if ( b->a_authz.sai_transport_ssf ) {
 808 #ifdef NEW_LOGGING
 809                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 810                                    "acl_mask: conn %d  check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 811                                    conn->c_connid, b->a_authz.sai_transport_ssf, op->o_transport_ssf ));
 812 #else
 813                         Debug( LDAP_DEBUG_ACL,
 814                                 "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 815                                 b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
 816 #endif
 817                         if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
 818                                 continue;
 819                         }
 820                 }
 821
 822                 if ( b->a_authz.sai_tls_ssf ) {
 823 #ifdef NEW_LOGGING
 824                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 825                                    "acl_mask: conn %d  check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 826                                    conn->c_connid, b->a_authz.sai_tls_ssf, op->o_tls_ssf ));
 827 #else
 828                         Debug( LDAP_DEBUG_ACL,
 829                                 "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 830                                 b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
 831 #endif
 832                         if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
 833                                 continue;
 834                         }
 835                 }
 836
 837                 if ( b->a_authz.sai_sasl_ssf ) {
 838 #ifdef NEW_LOGGING
 839                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 840                                    "acl_mask: conn %d check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 841                                    conn->c_connid, b->a_authz.sai_sasl_ssf, op->o_sasl_ssf ));
 842 #else
 843                         Debug( LDAP_DEBUG_ACL,
 844                                 "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 845                                 b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
 846 #endif
 847                         if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
 848                                 continue;
 849                         }
 850                 }
 851
 852 #ifdef SLAPD_ACI_ENABLED
 853                 if ( b->a_aci_at != NULL ) {
 854                         Attribute       *at;
 855                         slap_access_t grant, deny, tgrant, tdeny;
 856
 857                         /* this case works different from the others above.
 858                          * since aci's themselves give permissions, we need
 859                          * to first check b->a_access_mask, the ACL's access level.
 860                          */
 861
 862                         if ( e->e_nname.bv_len == 0 ) {
 863                                 /* no ACIs in the root DSE */
 864                                 continue;
 865                         }
 866
 867                         /* first check if the right being requested
 868                          * is allowed by the ACL clause.
 869                          */
 870                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
 871                                 continue;
 872                         }
 873
 874                         /* get the aci attribute */
 875                         at = attr_find( e->e_attrs, b->a_aci_at );
 876                         if ( at == NULL ) {
 877                                 continue;
 878                         }
 879
 880                         /* start out with nothing granted, nothing denied */
 881                         ACL_INIT(tgrant);
 882                         ACL_INIT(tdeny);
 883
 884                         /* the aci is an multi-valued attribute.  The
 885                          * rights are determined by OR'ing the individual
 886                          * rights given by the acis.
 887                          */
 888                         for ( i = 0; at->a_vals[i].bv_val != NULL; i++ ) {
 889                                 if (aci_mask( be, conn, op,
 890                                         e, desc, val, &at->a_vals[i],
 891                                         matches, &grant, &deny ) != 0)
 892                                 {
 893                                         tgrant |= grant;
 894                                         tdeny |= deny;
 895                                 }
 896                         }
 897
 898                         /* remove anything that the ACL clause does not allow */
 899                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
 900                         tdeny &= ACL_PRIV_MASK;
 901
 902                         /* see if we have anything to contribute */
 903                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
 904                                 continue;
 905                         }
 906
 907                         /* this could be improved by changing acl_mask so that it can deal with
 908                          * by clauses that return grant/deny pairs.  Right now, it does either
 909                          * additive or subtractive rights, but not both at the same time.  So,
 910                          * we need to combine the grant/deny pair into a single rights mask in
 911                          * a smart way:  if either grant or deny is "empty", then we use the
 912                          * opposite as is, otherwise we remove any denied rights from the grant
 913                          * rights mask and construct an additive mask.
 914                          */
 915                         if (ACL_IS_INVALID(tdeny)) {
 916                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
 917
 918                         } else if (ACL_IS_INVALID(tgrant)) {
 919                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
 920
 921                         } else {
 922                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
 923                         }
 924
 925                 } else
 926 #endif
 927                 {
 928                         modmask = b->a_access_mask;
 929                 }
 930
 931 #ifdef NEW_LOGGING
 932                 LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 933                            "acl_mask: conn %d  [%d] applying %s (%s)\n",
 934                            conn->c_connid, i, accessmask2str( modmask, accessmaskbuf),
 935                            b->a_type == ACL_CONTINUE ? "continue" : b->a_type == ACL_BREAK
 936                            ? "break" : "stop" ));
 937 #else
 938                 Debug( LDAP_DEBUG_ACL,
 939                         "<= acl_mask: [%d] applying %s (%s)\n",
 940                         i, accessmask2str( modmask, accessmaskbuf ),
 941                         b->a_type == ACL_CONTINUE
 942                                 ? "continue"
 943                                 : b->a_type == ACL_BREAK
 944                                         ? "break"
 945                                         : "stop" );
 946 #endif
 947                 /* save old mask */
 948                 oldmask = *mask;
 949
 950                 if( ACL_IS_ADDITIVE(modmask) ) {
 951                         /* add privs */
 952                         ACL_PRIV_SET( *mask, modmask );
 953
 954                         /* cleanup */
 955                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 956
 957                 } else if( ACL_IS_SUBTRACTIVE(modmask) ) {
 958                         /* substract privs */
 959                         ACL_PRIV_CLR( *mask, modmask );
 960
 961                         /* cleanup */
 962                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 963
 964                 } else {
 965                         /* assign privs */
 966                         *mask = modmask;
 967                 }
 968
 969 #ifdef NEW_LOGGING
 970                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
 971                            "acl_mask: conn %d  [%d] mask: %s\n",
 972                            conn->c_connid, i, accessmask2str( *mask, accessmaskbuf) ));
 973 #else
 974                 Debug( LDAP_DEBUG_ACL,
 975                         "<= acl_mask: [%d] mask: %s\n",
 976                         i, accessmask2str(*mask, accessmaskbuf), 0 );
 977 #endif
 978
 979                 if( b->a_type == ACL_CONTINUE ) {
 980                         continue;
 981
 982                 } else if ( b->a_type == ACL_BREAK ) {
 983                         return ACL_BREAK;
 984
 985                 } else {
 986                         return ACL_STOP;
 987                 }
 988         }
 989
 990         /* implicit "by * none" clause */
 991         ACL_INIT(*mask);
 992
 993 #ifdef NEW_LOGGING
 994         LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 995                    "acl_mask: conn %d  no more <who> clauses, returning %d (stop)\n",
 996                    conn->c_connid, accessmask2str( *mask, accessmaskbuf) ));
 997 #else
 998         Debug( LDAP_DEBUG_ACL,
 999                 "<= acl_mask: no more <who> clauses, returning %s (stop)\n",
1000                 accessmask2str(*mask, accessmaskbuf), 0, 0 );
1001 #endif
1002         return ACL_STOP;
1003 }
1004
1005 /*
1006  * acl_check_modlist - check access control on the given entry to see if
1007  * it allows the given modifications by the user associated with op.
1008  * returns      1       if mods allowed ok
1009  *                      0       mods not allowed
1010  */
1011
1012 int
1013 acl_check_modlist(
1014     Backend     *be,
1015     Connection  *conn,
1016     Operation   *op,
1017     Entry       *e,
1018     Modifications       *mlist
1019 )
1020 {
1021         struct berval *bv;
1022
1023         assert( be != NULL );
1024
1025         /* short circuit root database access */
1026         if ( be_isroot( be, &op->o_ndn ) ) {
1027 #ifdef NEW_LOGGING
1028                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
1029                            "acl_check_modlist: conn %d  access granted to root user\n",
1030                            conn->c_connid ));
1031 #else
1032                 Debug( LDAP_DEBUG_ACL,
1033                         "<= acl_access_allowed: granted to database root\n",
1034                     0, 0, 0 );
1035 #endif
1036                 return 1;
1037         }
1038
1039         /* use backend default access if no backend acls */
1040         if( be != NULL && be->be_acl == NULL ) {
1041 #ifdef NEW_LOGGING
1042                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1043                            "acl_check_modlist: conn %d  backend default %s access %s to \"%s\"\n",
1044                            conn->c_connid, access2str( ACL_WRITE ),
1045                            be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn.bv_val ));
1046 #else
1047                 Debug( LDAP_DEBUG_ACL,
1048                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
1049                         access2str( ACL_WRITE ),
1050                         be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn.bv_val );
1051 #endif
1052                 return be->be_dfltaccess >= ACL_WRITE;
1053
1054 #ifdef notdef
1055         /* be is always non-NULL */
1056         /* use global default access if no global acls */
1057         } else if ( be == NULL && global_acl == NULL ) {
1058 #ifdef NEW_LOGGING
1059                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1060                            "acl_check_modlist: conn %d  global default %s access %s to \"%s\"\n",
1061                            conn->c_connid, access2str( ACL_WRITE ),
1062                            global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn ));
1063 #else
1064                 Debug( LDAP_DEBUG_ACL,
1065                         "=> access_allowed: global default %s access %s to \"%s\"\n",
1066                         access2str( ACL_WRITE ),
1067                         global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn );
1068 #endif
1069                 return global_default_access >= ACL_WRITE;
1070 #endif
1071         }
1072
1073         for ( ; mlist != NULL; mlist = mlist->sml_next ) {
1074                 /*
1075                  * no-user-modification operational attributes are ignored
1076                  * by ACL_WRITE checking as any found here are not provided
1077                  * by the user
1078                  */
1079                 if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
1080 #ifdef NEW_LOGGING
1081                         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1082                                    "acl_check_modlist: conn %d  no-user-mod %s: modify access granted\n",
1083                                    conn->c_connid, mlist->sml_desc->ad_cname.bv_val ));
1084 #else
1085                         Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
1086                                 " modify access granted\n",
1087                                 mlist->sml_desc->ad_cname.bv_val, 0, 0 );
1088 #endif
1089                         continue;
1090                 }
1091
1092                 switch ( mlist->sml_op ) {
1093                 case LDAP_MOD_REPLACE:
1094                         if ( mlist->sml_bvalues == NULL ) {
1095                                 if ( ! access_allowed( be, conn, op, e,
1096                                         mlist->sml_desc, NULL, ACL_WRITE ) )
1097                                 {
1098                                         return( 0 );
1099                                 }
1100                                 break;
1101                         }
1102
1103                         /* fall thru */
1104
1105                 case LDAP_MOD_ADD:
1106                         assert( mlist->sml_bvalues != NULL );
1107
1108                         for ( bv = mlist->sml_bvalues; bv->bv_val != NULL; bv++ ) {
1109                                 if ( ! access_allowed( be, conn, op, e,
1110                                         mlist->sml_desc, bv, ACL_WRITE ) )
1111                                 {
1112                                         return( 0 );
1113                                 }
1114                         }
1115                         break;
1116
1117                 case LDAP_MOD_DELETE:
1118                         if ( mlist->sml_bvalues == NULL ) {
1119                                 if ( ! access_allowed( be, conn, op, e,
1120                                         mlist->sml_desc, NULL, ACL_WRITE ) )
1121                                 {
1122                                         return( 0 );
1123                                 }
1124                                 break;
1125                         }
1126                         for ( bv = mlist->sml_bvalues; bv->bv_val != NULL; bv++ ) {
1127                                 if ( ! access_allowed( be, conn, op, e,
1128                                         mlist->sml_desc, bv, ACL_WRITE ) )
1129                                 {
1130                                         return( 0 );
1131                                 }
1132                         }
1133                         break;
1134
1135                 default:
1136                         assert( 0 );
1137                         return( 0 );
1138                 }
1139         }
1140
1141         return( 1 );
1142 }
1143
1144 static char *
1145 aci_bvstrdup( struct berval *bv )
1146 {
1147         char *s;
1148
1149         s = (char *)ch_malloc(bv->bv_len + 1);
1150         if (s != NULL) {
1151                 AC_MEMCPY(s, bv->bv_val, bv->bv_len);
1152                 s[bv->bv_len] = 0;
1153         }
1154         return(s);
1155 }
1156
1157 #ifdef SLAPD_ACI_ENABLED
1158 static int
1159 aci_strbvcmp(
1160         const char *s,
1161         struct berval *bv )
1162 {
1163         int res, len;
1164
1165         res = strncasecmp( s, bv->bv_val, bv->bv_len );
1166         if (res)
1167                 return(res);
1168         len = strlen(s);
1169         if (len > (int)bv->bv_len)
1170                 return(1);
1171         if (len < (int)bv->bv_len)
1172                 return(-1);
1173         return(0);
1174 }
1175 #endif
1176
1177 static int
1178 aci_get_part(
1179         struct berval *list,
1180         int ix,
1181         char sep,
1182         struct berval *bv )
1183 {
1184         int len;
1185         char *p;
1186
1187         if (bv) {
1188                 bv->bv_len = 0;
1189                 bv->bv_val = NULL;
1190         }
1191         len = list->bv_len;
1192         p = list->bv_val;
1193         while (len >= 0 && --ix >= 0) {
1194                 while (--len >= 0 && *p++ != sep) ;
1195         }
1196         while (len >= 0 && *p == ' ') {
1197                 len--;
1198                 p++;
1199         }
1200         if (len < 0)
1201                 return(-1);
1202
1203         if (!bv)
1204                 return(0);
1205
1206         bv->bv_val = p;
1207         while (--len >= 0 && *p != sep) {
1208                 bv->bv_len++;
1209                 p++;
1210         }
1211         while (bv->bv_len > 0 && *--p == ' ')
1212                 bv->bv_len--;
1213         return(bv->bv_len);
1214 }
1215
1216 BerVarray
1217 aci_set_gather (void *cookie, char *name, struct berval *attr)
1218 {
1219         AciSetCookie *cp = cookie;
1220         BerVarray bvals = NULL;
1221         struct berval bv, ndn;
1222
1223         /* this routine needs to return the bervals instead of
1224          * plain strings, since syntax is not known.  It should
1225          * also return the syntax or some "comparison cookie".
1226          */
1227
1228         bv.bv_val = name;
1229         bv.bv_len = strlen( name );
1230         if (dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS) {
1231                 const char *text;
1232                 AttributeDescription *desc = NULL;
1233                 if (slap_bv2ad(attr, &desc, &text) == LDAP_SUCCESS) {
1234                         backend_attribute(cp->be, NULL, NULL,
1235                                 cp->e, &ndn, desc, &bvals);
1236                 }
1237                 free(ndn.bv_val);
1238         }
1239         return(bvals);
1240 }
1241
1242 static int
1243 aci_match_set (
1244         struct berval *subj,
1245     Backend *be,
1246     Entry *e,
1247     Connection *conn,
1248     Operation *op,
1249     int setref
1250 )
1251 {
1252         struct berval set = { 0, NULL };
1253         int rc = 0;
1254         AciSetCookie cookie;
1255
1256         if (setref == 0) {
1257                 ber_dupbv( &set, subj );
1258         } else {
1259                 struct berval subjdn, ndn = { 0, NULL };
1260                 struct berval setat;
1261                 BerVarray bvals;
1262                 const char *text;
1263                 AttributeDescription *desc = NULL;
1264
1265                 /* format of string is "entry/setAttrName" */
1266                 if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
1267                         return(0);
1268                 } else {
1269                         /* FIXME: If dnNormalize was based on ldap_bv2dn
1270                          * instead of ldap_str2dn and would honor the bv_len
1271                          * we could skip this step and not worry about the
1272                          * unterminated string.
1273                          */
1274                         char *s = ch_malloc(subjdn.bv_len + 1);
1275                         AC_MEMCPY(s, subjdn.bv_val, subjdn.bv_len);
1276                         subjdn.bv_val = s;
1277                 }
1278
1279                 if ( aci_get_part(subj, 1, '/', &setat) < 0 ) {
1280                         setat.bv_val = SLAPD_ACI_SET_ATTR;
1281                         setat.bv_len = sizeof(SLAPD_ACI_SET_ATTR)-1;
1282                 }
1283                 if ( setat.bv_val != NULL ) {
1284                         if ( dnNormalize2(NULL, &subjdn, &ndn) == LDAP_SUCCESS
1285                                 && slap_bv2ad(&setat, &desc, &text) == LDAP_SUCCESS )
1286                         {
1287                                 backend_attribute(be, NULL, NULL, e,
1288                                         &ndn, desc, &bvals);
1289                                 if ( bvals != NULL ) {
1290                                         if ( bvals[0].bv_val != NULL ) {
1291                                                 int i;
1292                                                 set = bvals[0];
1293                                                 bvals[0].bv_val = NULL;
1294                                                 for (i=1;bvals[i].bv_val;i++);
1295                                                 bvals[0].bv_val = bvals[i-1].bv_val;
1296                                                 bvals[i-1].bv_val = NULL;
1297                                         }
1298                                         ber_bvarray_free(bvals);
1299                                 }
1300                         }
1301                         if (ndn.bv_val)
1302                                 free(ndn.bv_val);
1303                 }
1304                 ch_free(subjdn.bv_val);
1305         }
1306
1307         if (set.bv_val != NULL) {
1308                 cookie.be = be;
1309                 cookie.e = e;
1310                 cookie.conn = conn;
1311                 cookie.op = op;
1312                 rc = (slap_set_filter(aci_set_gather, &cookie, &set,
1313                         op->o_ndn.bv_val, e->e_ndn, NULL) > 0);
1314                 ch_free(set.bv_val);
1315         }
1316         return(rc);
1317 }
1318
1319 #ifdef SLAPD_ACI_ENABLED
1320 static int
1321 aci_list_map_rights(
1322         struct berval *list )
1323 {
1324         struct berval bv;
1325         slap_access_t mask;
1326         int i;
1327
1328         ACL_INIT(mask);
1329         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1330                 if (bv.bv_len <= 0)
1331                         continue;
1332                 switch (*bv.bv_val) {
1333                 case 'c':
1334                         ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
1335                         break;
1336                 case 's':
1337                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
1338                          * the right 's' to mean "set", but in the examples states
1339                          * that the right 's' means "search".  The latter definition
1340                          * is used here.
1341                          */
1342                         ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
1343                         break;
1344                 case 'r':
1345                         ACL_PRIV_SET(mask, ACL_PRIV_READ);
1346                         break;
1347                 case 'w':
1348                         ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
1349                         break;
1350                 case 'x':
1351                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
1352                          * define any equivalent to the AUTH right, so I've just used
1353                          * 'x' for now.
1354                          */
1355                         ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
1356                         break;
1357                 default:
1358                         break;
1359                 }
1360
1361         }
1362         return(mask);
1363 }
1364
1365 static int
1366 aci_list_has_attr(
1367         struct berval *list,
1368         const char *attr,
1369         struct berval *val )
1370 {
1371         struct berval bv, left, right;
1372         int i;
1373
1374         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1375                 if (aci_get_part(&bv, 0, '=', &left) < 0
1376                         || aci_get_part(&bv, 1, '=', &right) < 0)
1377                 {
1378                         if (aci_strbvcmp(attr, &bv) == 0)
1379                                 return(1);
1380                 } else if (val == NULL) {
1381                         if (aci_strbvcmp(attr, &left) == 0)
1382                                 return(1);
1383                 } else {
1384                         if (aci_strbvcmp(attr, &left) == 0) {
1385                                 /* this is experimental code that implements a
1386                                  * simple (prefix) match of the attribute value.
1387                                  * the ACI draft does not provide for aci's that
1388                                  * apply to specific values, but it would be
1389                                  * nice to have.  If the <attr> part of an aci's
1390                                  * rights list is of the form <attr>=<value>,
1391                                  * that means the aci applies only to attrs with
1392                                  * the given value.  Furthermore, if the attr is
1393                                  * of the form <attr>=<value>*, then <value> is
1394                                  * treated as a prefix, and the aci applies to
1395                                  * any value with that prefix.
1396                                  *
1397                                  * Ideally, this would allow r.e. matches.
1398                                  */
1399                                 if (aci_get_part(&right, 0, '*', &left) < 0
1400                                         || right.bv_len <= left.bv_len)
1401                                 {
1402                                         if (aci_strbvcmp(val->bv_val, &right) == 0)
1403                                                 return(1);
1404                                 } else if (val->bv_len >= left.bv_len) {
1405                                         if (strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0)
1406                                                 return(1);
1407                                 }
1408                         }
1409                 }
1410         }
1411         return(0);
1412 }
1413
1414 static slap_access_t
1415 aci_list_get_attr_rights(
1416         struct berval *list,
1417         const char *attr,
1418         struct berval *val )
1419 {
1420     struct berval bv;
1421     slap_access_t mask;
1422     int i;
1423
1424         /* loop through each rights/attr pair, skip first part (action) */
1425         ACL_INIT(mask);
1426         for (i = 1; aci_get_part(list, i + 1, ';', &bv) >= 0; i += 2) {
1427                 if (aci_list_has_attr(&bv, attr, val) == 0)
1428                         continue;
1429                 if (aci_get_part(list, i, ';', &bv) < 0)
1430                         continue;
1431                 mask |= aci_list_map_rights(&bv);
1432         }
1433         return(mask);
1434 }
1435
1436 static int
1437 aci_list_get_rights(
1438         struct berval *list,
1439         const char *attr,
1440         struct berval *val,
1441         slap_access_t *grant,
1442         slap_access_t *deny )
1443 {
1444     struct berval perm, actn;
1445     slap_access_t *mask;
1446     int i, found;
1447
1448         if (attr == NULL || *attr == 0 || strcasecmp(attr, "entry") == 0) {
1449                 attr = "[entry]";
1450         }
1451
1452         found = 0;
1453         ACL_INIT(*grant);
1454         ACL_INIT(*deny);
1455         /* loop through each permissions clause */
1456         for (i = 0; aci_get_part(list, i, '$', &perm) >= 0; i++) {
1457                 if (aci_get_part(&perm, 0, ';', &actn) < 0)
1458                         continue;
1459                 if (aci_strbvcmp( "grant", &actn ) == 0) {
1460                         mask = grant;
1461                 } else if (aci_strbvcmp( "deny", &actn ) == 0) {
1462                         mask = deny;
1463                 } else {
1464                         continue;
1465                 }
1466
1467                 found = 1;
1468                 *mask |= aci_list_get_attr_rights(&perm, attr, val);
1469                 *mask |= aci_list_get_attr_rights(&perm, "[all]", NULL);
1470         }
1471         return(found);
1472 }
1473
1474 static int
1475 aci_group_member (
1476         struct berval *subj,
1477         struct berval *defgrpoc,
1478         struct berval *defgrpat,
1479     Backend             *be,
1480     Entry               *e,
1481     Connection          *conn,
1482     Operation           *op,
1483         regmatch_t      *matches
1484 )
1485 {
1486         struct berval bv;
1487         char *subjdn;
1488         struct berval grpoc;
1489         struct berval grpat;
1490         ObjectClass *grp_oc = NULL;
1491         AttributeDescription *grp_ad = NULL;
1492         const char *text;
1493         int rc;
1494
1495         /* format of string is "group/objectClassValue/groupAttrName" */
1496         if (aci_get_part(subj, 0, '/', &bv) < 0) {
1497                 return(0);
1498         }
1499
1500         subjdn = aci_bvstrdup(&bv);
1501         if (subjdn == NULL) {
1502                 return(0);
1503         }
1504
1505         if (aci_get_part(subj, 1, '/', &grpoc) < 0) {
1506                 grpoc = *defgrpoc;
1507         }
1508
1509         if (aci_get_part(subj, 2, '/', &grpat) < 0) {
1510                 grpat = *defgrpat;
1511         }
1512
1513         rc = slap_bv2ad( &grpat, &grp_ad, &text );
1514         if( rc != LDAP_SUCCESS ) {
1515                 rc = 0;
1516                 goto done;
1517         }
1518         rc = 0;
1519
1520         grp_oc = oc_bvfind( &grpoc );
1521
1522         if (grp_oc != NULL && grp_ad != NULL ) {
1523                 struct berval ndn;
1524                 bv.bv_val = (char *)ch_malloc(1024);
1525                 bv.bv_len = 1024;
1526                 string_expand(&bv, subjdn, e->e_ndn, matches);
1527                 if ( dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS ) {
1528                         rc = (backend_group(be, conn, op, e, &ndn, &op->o_ndn, grp_oc, grp_ad) == 0);
1529                         free( ndn.bv_val );
1530                 }
1531                 ch_free(bv.bv_val);
1532         }
1533
1534 done:
1535         ch_free(subjdn);
1536         return(rc);
1537 }
1538
1539 static struct berval GroupClass = {
1540         sizeof(SLAPD_GROUP_CLASS)-1, SLAPD_GROUP_CLASS };
1541 static struct berval GroupAttr = {
1542         sizeof(SLAPD_GROUP_ATTR)-1, SLAPD_GROUP_ATTR };
1543 static struct berval RoleClass = {
1544         sizeof(SLAPD_ROLE_CLASS)-1, SLAPD_ROLE_CLASS };
1545 static struct berval RoleAttr = {
1546         sizeof(SLAPD_ROLE_ATTR)-1, SLAPD_ROLE_ATTR };
1547
1548 static int
1549 aci_mask(
1550     Backend                     *be,
1551     Connection          *conn,
1552     Operation           *op,
1553     Entry                       *e,
1554         AttributeDescription *desc,
1555     struct berval       *val,
1556     struct berval       *aci,
1557         regmatch_t              *matches,
1558         slap_access_t   *grant,
1559         slap_access_t   *deny
1560 )
1561 {
1562     struct berval bv, perms, sdn;
1563         int rc;
1564         char *attr = desc->ad_cname.bv_val;
1565
1566         assert( attr != NULL );
1567
1568         /* parse an aci of the form:
1569                 oid#scope#action;rights;attr;rights;attr$action;rights;attr;rights;attr#dnType#subjectDN
1570
1571            See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
1572            a full description of the format for this attribute.
1573
1574            For now, this routine only supports scope=entry.
1575          */
1576
1577         /* check that the aci has all 5 components */
1578         if (aci_get_part(aci, 4, '#', NULL) < 0)
1579                 return(0);
1580
1581         /* check that the aci family is supported */
1582         if (aci_get_part(aci, 0, '#', &bv) < 0)
1583                 return(0);
1584
1585         /* check that the scope is "entry" */
1586         if (aci_get_part(aci, 1, '#', &bv) < 0
1587                 || aci_strbvcmp( "entry", &bv ) != 0)
1588         {
1589                 return(0);
1590         }
1591
1592         /* get the list of permissions clauses, bail if empty */
1593         if (aci_get_part(aci, 2, '#', &perms) <= 0)
1594                 return(0);
1595
1596         /* check if any permissions allow desired access */
1597         if (aci_list_get_rights(&perms, attr, val, grant, deny) == 0)
1598                 return(0);
1599
1600         /* see if we have a DN match */
1601         if (aci_get_part(aci, 3, '#', &bv) < 0)
1602                 return(0);
1603
1604         if (aci_get_part(aci, 4, '#', &sdn) < 0)
1605                 return(0);
1606
1607         if (aci_strbvcmp( "access-id", &bv ) == 0) {
1608                 struct berval ndn;
1609                 rc = 1;
1610                 if ( dnNormalize2(NULL, &sdn, &ndn) == LDAP_SUCCESS ) {
1611                         if (strcasecmp(op->o_ndn.bv_val, ndn.bv_val) != 0)
1612                                 rc = 0;
1613                         free(ndn.bv_val);
1614                 }
1615                 return(rc);
1616         }
1617
1618         if (aci_strbvcmp( "self", &bv ) == 0) {
1619                 if (dn_match(&op->o_ndn, &e->e_nname))
1620                         return(1);
1621
1622         } else if (aci_strbvcmp( "dnattr", &bv ) == 0) {
1623                 char *dnattr = aci_bvstrdup(&sdn);
1624                 Attribute *at;
1625                 AttributeDescription *ad = NULL;
1626                 const char *text;
1627
1628                 rc = slap_str2ad( dnattr, &ad, &text );
1629                 ch_free( dnattr );
1630
1631                 if( rc != LDAP_SUCCESS ) {
1632                         return 0;
1633                 }
1634
1635                 rc = 0;
1636
1637                 bv = op->o_ndn;
1638
1639                 for(at = attrs_find( e->e_attrs, ad );
1640                         at != NULL;
1641                         at = attrs_find( at->a_next, ad ) )
1642                 {
1643                         if (value_find( ad, at->a_vals, &bv) == 0 ) {
1644                                 rc = 1;
1645                                 break;
1646                         }
1647                 }
1648
1649                 return rc;
1650
1651
1652         } else if (aci_strbvcmp( "group", &bv ) == 0) {
1653                 if (aci_group_member(&sdn, &GroupClass, &GroupAttr, be, e, conn, op, matches))
1654                         return(1);
1655
1656         } else if (aci_strbvcmp( "role", &bv ) == 0) {
1657                 if (aci_group_member(&sdn, &RoleClass, &RoleAttr, be, e, conn, op, matches))
1658                         return(1);
1659
1660         } else if (aci_strbvcmp( "set", &bv ) == 0) {
1661                 if (aci_match_set(&sdn, be, e, conn, op, 0))
1662                         return(1);
1663
1664         } else if (aci_strbvcmp( "set-ref", &bv ) == 0) {
1665                 if (aci_match_set(&sdn, be, e, conn, op, 1))
1666                         return(1);
1667
1668         }
1669
1670         return(0);
1671 }
1672
1673 #endif  /* SLAPD_ACI_ENABLED */
1674
1675 static void
1676 string_expand(
1677         struct berval *bv,
1678         char *pat,
1679         char *match,
1680         regmatch_t *matches)
1681 {
1682         ber_len_t       size;
1683         char   *sp;
1684         char   *dp;
1685         int     flag;
1686
1687         size = 0;
1688         bv->bv_val[0] = '\0';
1689         bv->bv_len--; /* leave space for lone $ */
1690
1691         flag = 0;
1692         for ( dp = bv->bv_val, sp = pat; size < bv->bv_len && *sp ; sp++) {
1693                 /* did we previously see a $ */
1694                 if (flag) {
1695                         if (*sp == '$') {
1696                                 *dp++ = '$';
1697                                 size++;
1698                         } else if (*sp >= '0' && *sp <= '9' ) {
1699                                 int     n;
1700                                 int     i;
1701                                 int     l;
1702
1703                                 n = *sp - '0';
1704                                 *dp = '\0';
1705                                 i = matches[n].rm_so;
1706                                 l = matches[n].rm_eo;
1707                                 for ( ; size < bv->bv_len && i < l; size++, i++ ) {
1708                                         *dp++ = match[i];
1709                                         size++;
1710                                 }
1711                                 *dp = '\0';
1712                         }
1713                         flag = 0;
1714                 } else {
1715                         if (*sp == '$') {
1716                                 flag = 1;
1717                         } else {
1718                                 *dp++ = *sp;
1719                                 size++;
1720                         }
1721                 }
1722         }
1723
1724         if (flag) {
1725                 /* must have ended with a single $ */
1726                 *dp++ = '$';
1727                 size++;
1728         }
1729
1730         *dp = '\0';
1731         bv->bv_len = size;
1732
1733 #ifdef NEW_LOGGING
1734         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1735                    "string_expand:  pattern = %s\n", pat ));
1736         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1737                    "string_expand:  expanded = %s\n", bv->bv_val ));
1738 #else
1739         Debug( LDAP_DEBUG_TRACE, "=> string_expand: pattern:  %s\n", pat, 0, 0 );
1740         Debug( LDAP_DEBUG_TRACE, "=> string_expand: expanded: %s\n", bv->bv_val, 0, 0 );
1741 #endif
1742 }
1743
1744 static int
1745 regex_matches(
1746         char *pat,                              /* pattern to expand and match against */
1747         char *str,                              /* string to match against pattern */
1748         char *buf,                              /* buffer with $N expansion variables */
1749         regmatch_t *matches             /* offsets in buffer for $N expansion variables */
1750 )
1751 {
1752         regex_t re;
1753         char newbuf[512];
1754         struct berval bv = {sizeof(newbuf), newbuf};
1755         int     rc;
1756
1757         if(str == NULL) str = "";
1758
1759         string_expand(&bv, pat, buf, matches);
1760         if (( rc = regcomp(&re, newbuf, REG_EXTENDED|REG_ICASE))) {
1761                 char error[512];
1762                 regerror(rc, &re, error, sizeof(error));
1763
1764 #ifdef NEW_LOGGING
1765                 LDAP_LOG(( "aci", LDAP_LEVEL_ERR,
1766                            "regex_matches: compile( \"%s\", \"%s\") failed %s\n",
1767                            pat, str, error ));
1768 #else
1769                 Debug( LDAP_DEBUG_TRACE,
1770                     "compile( \"%s\", \"%s\") failed %s\n",
1771                         pat, str, error );
1772 #endif
1773                 return( 0 );
1774         }
1775
1776         rc = regexec(&re, str, 0, NULL, 0);
1777         regfree( &re );
1778
1779 #ifdef NEW_LOGGING
1780         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1781                    "regex_matches: string:   %s\n", str ));
1782         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1783                    "regex_matches: rc:  %d  %s\n",
1784                    rc, rc ? "matches" : "no matches" ));
1785 #else
1786         Debug( LDAP_DEBUG_TRACE,
1787             "=> regex_matches: string:   %s\n", str, 0, 0 );
1788         Debug( LDAP_DEBUG_TRACE,
1789             "=> regex_matches: rc: %d %s\n",
1790                 rc, !rc ? "matches" : "no matches", 0 );
1791 #endif
1792         return( !rc );
1793 }
1794