git.sur5r.net Git - openldap/blob - servers/slapd/acl.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/regex.h>
  13 #include <ac/socket.h>
  14 #include <ac/string.h>
  15
  16 #include "slap.h"
  17 #include "sets.h"
  18
  19 static AccessControl * acl_get(
  20         AccessControl *ac, int *count,
  21         Backend *be, Operation *op,
  22         Entry *e,
  23         AttributeDescription *desc,
  24         int nmatches, regmatch_t *matches );
  25
  26 static slap_control_t acl_mask(
  27         AccessControl *ac, slap_mask_t *mask,
  28         Backend *be, Connection *conn, Operation *op,
  29         Entry *e,
  30         AttributeDescription *desc,
  31         struct berval *val,
  32         regmatch_t *matches );
  33
  34 #ifdef SLAPD_ACI_ENABLED
  35 static int aci_mask(
  36         Backend *be,
  37     Connection *conn,
  38         Operation *op,
  39         Entry *e,
  40         AttributeDescription *desc,
  41         struct berval *val,
  42         struct berval *aci,
  43         regmatch_t *matches,
  44         slap_access_t *grant,
  45         slap_access_t *deny );
  46 #endif
  47
  48 static int      regex_matches(
  49         char *pat, char *str, char *buf, regmatch_t *matches);
  50 static void     string_expand(
  51         struct berval *newbuf, char *pattern,
  52         char *match, regmatch_t *matches);
  53
  54 typedef struct AciSetCookie {
  55         Backend *be;
  56         Entry *e;
  57         Connection *conn;
  58         Operation *op;
  59 } AciSetCookie;
  60
  61 BVarray aci_set_gather (void *cookie, char *name, struct berval *attr);
  62 static int aci_match_set ( struct berval *subj, Backend *be,
  63     Entry *e, Connection *conn, Operation *op, int setref );
  64
  65 /*
  66  * access_allowed - check whether op->o_ndn is allowed the requested access
  67  * to entry e, attribute attr, value val.  if val is null, access to
  68  * the whole attribute is assumed (all values).
  69  *
  70  * This routine loops through all access controls and calls
  71  * acl_mask() on each applicable access control.
  72  * The loop exits when a definitive answer is reached or
  73  * or no more controls remain.
  74  *
  75  * returns:
  76  *              0       access denied
  77  *              1       access granted
  78  */
  79
  80 int
  81 access_allowed(
  82     Backend             *be,
  83     Connection          *conn,
  84     Operation           *op,
  85     Entry               *e,
  86         AttributeDescription    *desc,
  87     struct berval       *val,
  88     slap_access_t       access )
  89 {
  90         int                             count;
  91         AccessControl   *a;
  92 #ifdef LDAP_DEBUG
  93         char accessmaskbuf[ACCESSMASK_MAXLEN];
  94 #endif
  95         slap_mask_t mask;
  96         slap_control_t control;
  97         const char *attr;
  98         regmatch_t matches[MAXREMATCHES];
  99
 100         assert( e != NULL );
 101         assert( desc != NULL );
 102         assert( access > ACL_NONE );
 103
 104         attr = desc->ad_cname.bv_val;
 105
 106         assert( attr != NULL );
 107
 108 #ifdef NEW_LOGGING
 109         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 110                 "access_allowed: conn %d %s access to \"%s\" \"%s\" requested\n",
 111                 conn ? conn->c_connid : -1, access2str( access ), e->e_dn, attr ));
 112 #else
 113         Debug( LDAP_DEBUG_ACL,
 114                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 115             access2str( access ), e->e_dn, attr );
 116 #endif
 117
 118         if ( op == NULL ) {
 119                 /* no-op call */
 120                 return 1;
 121         }
 122
 123         if ( be == NULL ) be = &backends[0];
 124         assert( be != NULL );
 125
 126         /* grant database root access */
 127         if ( be != NULL && be_isroot( be, &op->o_ndn ) ) {
 128 #ifdef NEW_LOGGING
 129                 LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
 130                        "access_allowed: conn %d root access granted\n",
 131                        conn->c_connid));
 132 #else
 133                 Debug( LDAP_DEBUG_ACL,
 134                     "<= root access granted\n",
 135                         0, 0, 0 );
 136 #endif
 137                 return 1;
 138         }
 139
 140         /*
 141          * no-user-modification operational attributes are ignored
 142          * by ACL_WRITE checking as any found here are not provided
 143          * by the user
 144          */
 145         if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 146                 && desc != slap_schema.si_ad_entry
 147                 && desc != slap_schema.si_ad_children )
 148         {
 149 #ifdef NEW_LOGGING
 150                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 151                        "access_allowed: conn %d NoUserMod Operational attribute: %s access granted\n",
 152                        conn->c_connid, attr ));
 153 #else
 154                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 155                         " %s access granted\n",
 156                         attr, 0, 0 );
 157 #endif
 158                 return 1;
 159         }
 160
 161         /* use backend default access if no backend acls */
 162         if( be != NULL && be->be_acl == NULL ) {
 163 #ifdef NEW_LOGGING
 164                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 165                        "access_allowed: conn %d backend default %s access %s to \"%s\"\n",
 166                        conn->c_connid, access2str( access ),
 167                        be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val ));
 168 #else
 169                 Debug( LDAP_DEBUG_ACL,
 170                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
 171                         access2str( access ),
 172                         be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val );
 173 #endif
 174                 return be->be_dfltaccess >= access;
 175
 176 #ifdef notdef
 177         /* be is always non-NULL */
 178         /* use global default access if no global acls */
 179         } else if ( be == NULL && global_acl == NULL ) {
 180 #ifdef NEW_LOGGING
 181                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 182                        "access_allowed: conn %d global default %s access %s to \"%s\"\n",
 183                        conn->c_connid, access2str( access ),
 184                        global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val ));
 185 #else
 186                 Debug( LDAP_DEBUG_ACL,
 187                         "=> access_allowed: global default %s access %s to \"%s\"\n",
 188                         access2str( access ),
 189                         global_default_access >= access ? "granted" : "denied", op->o_dn.bv_val );
 190 #endif
 191                 return global_default_access >= access;
 192 #endif
 193         }
 194
 195         ACL_INIT(mask);
 196         memset(matches, '\0', sizeof(matches));
 197
 198         control = ACL_BREAK;
 199         a = NULL;
 200         count = 0;
 201
 202         while((a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches )) != NULL)
 203         {
 204                 int i;
 205
 206                 for (i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++) {
 207 #ifdef NEW_LOGGING
 208                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 209                                "access_allowed: conn %d match[%d]:  %d %d ",
 210                                conn->c_connid, i, (int)matches[i].rm_so, (int)matches[i].rm_eo ));
 211 #else
 212                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 213                                (int)matches[i].rm_so, (int)matches[i].rm_eo );
 214 #endif
 215                         if( matches[i].rm_so <= matches[0].rm_eo ) {
 216                                 int n;
 217                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++) {
 218                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 219                                 }
 220                         }
 221 #ifdef NEW_LOGGING
 222                         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS, "\n" ));
 223 #else
 224                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 225 #endif
 226                 }
 227
 228                 control = acl_mask( a, &mask, be, conn, op,
 229                         e, desc, val, matches );
 230
 231                 if ( control != ACL_BREAK ) {
 232                         break;
 233                 }
 234
 235                 memset(matches, '\0', sizeof(matches));
 236         }
 237
 238         if ( ACL_IS_INVALID( mask ) ) {
 239 #ifdef NEW_LOGGING
 240                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 241                        "access_allowed: conn %d  \"%s\" (%s) invalid!\n",
 242                        conn->c_connid, e->e_dn, attr ));
 243 #else
 244                 Debug( LDAP_DEBUG_ACL,
 245                         "=> access_allowed: \"%s\" (%s) invalid!\n",
 246                         e->e_dn, attr, 0 );
 247 #endif
 248                 ACL_INIT( mask );
 249
 250         } else if ( control == ACL_BREAK ) {
 251 #ifdef NEW_LOGGING
 252                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 253                        "access_allowed: conn %d  no more rules\n", conn->c_connid ));
 254 #else
 255                 Debug( LDAP_DEBUG_ACL,
 256                         "=> access_allowed: no more rules\n", 0, 0, 0);
 257 #endif
 258                 ACL_INIT( mask );
 259         }
 260
 261 #ifdef NEW_LOGGING
 262         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 263                    "access_allowed: conn %d  %s access %s by %s\n",
 264                    conn->c_connid,
 265                    access2str( access ),
 266                    ACL_GRANT( mask, access ) ? "granted" : "denied",
 267                    accessmask2str( mask, accessmaskbuf ) ));
 268 #else
 269         Debug( LDAP_DEBUG_ACL,
 270                 "=> access_allowed: %s access %s by %s\n",
 271                 access2str( access ),
 272                 ACL_GRANT(mask, access) ? "granted" : "denied",
 273                 accessmask2str( mask, accessmaskbuf ) );
 274 #endif
 275         return ACL_GRANT(mask, access);
 276 }
 277
 278 /*
 279  * acl_get - return the acl applicable to entry e, attribute
 280  * attr.  the acl returned is suitable for use in subsequent calls to
 281  * acl_access_allowed().
 282  */
 283
 284 static AccessControl *
 285 acl_get(
 286         AccessControl *a,
 287         int                     *count,
 288     Backend             *be,
 289     Operation   *op,
 290     Entry               *e,
 291         AttributeDescription *desc,
 292     int                 nmatch,
 293     regmatch_t  *matches )
 294 {
 295         const char *attr;
 296         int dnlen, patlen;
 297
 298         assert( e != NULL );
 299         assert( count != NULL );
 300         assert( desc != NULL );
 301
 302         attr = desc->ad_cname.bv_val;
 303
 304         assert( attr != NULL );
 305
 306         if( a == NULL ) {
 307                 if( be == NULL ) {
 308                         a = global_acl;
 309                 } else {
 310                         a = be->be_acl;
 311                 }
 312
 313                 assert( a != NULL );
 314
 315         } else {
 316                 a = a->acl_next;
 317         }
 318
 319         dnlen = e->e_nname.bv_len;
 320
 321         for ( ; a != NULL; a = a->acl_next ) {
 322                 (*count) ++;
 323
 324                 if (a->acl_dn_pat.bv_len != 0) {
 325                         if ( a->acl_dn_style == ACL_STYLE_REGEX ) {
 326 #ifdef NEW_LOGGING
 327                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 328                                            "acl_get: dnpat [%d] %s nsub: %d\n",
 329                                            *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub ));
 330 #else
 331                                 Debug( LDAP_DEBUG_ACL, "=> dnpat: [%d] %s nsub: %d\n",
 332                                         *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub );
 333 #endif
 334                                 if (regexec(&a->acl_dn_re, e->e_ndn, nmatch, matches, 0))
 335                                         continue;
 336
 337                         } else {
 338 #ifdef NEW_LOGGING
 339                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 340                                            "acl_get: dn [%d] %s\n",
 341                                            *count, a->acl_dn_pat.bv_val ));
 342 #else
 343                                 Debug( LDAP_DEBUG_ACL, "=> dn: [%d] %s\n",
 344                                         *count, a->acl_dn_pat.bv_val, 0 );
 345 #endif
 346                                 patlen = a->acl_dn_pat.bv_len;
 347                                 if ( dnlen < patlen )
 348                                         continue;
 349
 350                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 351                                         /* base dn -- entire object DN must match */
 352                                         if ( dnlen != patlen )
 353                                                 continue;
 354
 355                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 356                                         int rdnlen = -1;
 357
 358                                         if ( dnlen <= patlen )
 359                                                 continue;
 360
 361                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 362                                                 continue;
 363
 364                                         rdnlen = dn_rdnlen( NULL, &e->e_nname );
 365                                         if ( rdnlen != dnlen - patlen - 1 )
 366                                                 continue;
 367
 368                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 369                                         if ( dnlen > patlen && ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) ) )
 370                                                 continue;
 371
 372                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 373                                         if ( dnlen <= patlen )
 374                                                 continue;
 375                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 376                                                 continue;
 377                                 }
 378
 379                                 if ( strcmp( a->acl_dn_pat.bv_val, e->e_ndn + dnlen - patlen ) != 0 )
 380                                         continue;
 381                         }
 382
 383 #ifdef NEW_LOGGING
 384                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 385                                    "acl_get: [%d] matched\n",
 386                                    *count ));
 387 #else
 388                         Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] matched\n",
 389                                 *count, 0, 0 );
 390 #endif
 391                 }
 392
 393                 if ( a->acl_filter != NULL ) {
 394                         ber_int_t rc = test_filter( NULL, NULL, NULL, e, a->acl_filter );
 395                         if ( rc != LDAP_COMPARE_TRUE ) {
 396                                 continue;
 397                         }
 398                 }
 399
 400 #ifdef NEW_LOGGING
 401                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 402                            "acl_get: [%d] check attr %s\n",
 403                            *count, attr ));
 404 #else
 405                 Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] check attr %s\n",
 406                        *count, attr, 0);
 407 #endif
 408                 if ( attr == NULL || a->acl_attrs == NULL ||
 409                         ad_inlist( desc, a->acl_attrs ) )
 410                 {
 411 #ifdef NEW_LOGGING
 412                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 413                                    "acl_get:  [%d] acl %s attr: %s\n",
 414                                    *count, e->e_dn, attr ));
 415 #else
 416                         Debug( LDAP_DEBUG_ACL,
 417                                 "<= acl_get: [%d] acl %s attr: %s\n",
 418                                 *count, e->e_dn, attr );
 419 #endif
 420                         return a;
 421                 }
 422                 matches[0].rm_so = matches[0].rm_eo = -1;
 423         }
 424
 425 #ifdef NEW_LOGGING
 426         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 427                    "acl_get: done.\n" ));
 428 #else
 429         Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
 430 #endif
 431         return( NULL );
 432 }
 433
 434
 435 /*
 436  * acl_mask - modifies mask based upon the given acl and the
 437  * requested access to entry e, attribute attr, value val.  if val
 438  * is null, access to the whole attribute is assumed (all values).
 439  *
 440  * returns      0       access NOT allowed
 441  *              1       access allowed
 442  */
 443
 444 static slap_control_t
 445 acl_mask(
 446     AccessControl       *a,
 447         slap_mask_t *mask,
 448     Backend             *be,
 449     Connection  *conn,
 450     Operation   *op,
 451     Entry               *e,
 452         AttributeDescription *desc,
 453     struct berval       *val,
 454         regmatch_t      *matches
 455 )
 456 {
 457         int             i, odnlen, patlen;
 458         Access  *b;
 459 #ifdef LDAP_DEBUG
 460         char accessmaskbuf[ACCESSMASK_MAXLEN];
 461 #endif
 462         const char *attr;
 463
 464         assert( a != NULL );
 465         assert( mask != NULL );
 466         assert( desc != NULL );
 467
 468         attr = desc->ad_cname.bv_val;
 469
 470         assert( attr != NULL );
 471
 472 #ifdef NEW_LOGGING
 473         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 474                    "acl_mask: conn %d  access to entry \"%s\", attr \"%s\" requested\n",
 475                    conn->c_connid, e->e_dn, attr ));
 476
 477         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS,
 478                    " to %s by \"%s\", (%s) \n",
 479                    val ? "value" : "all values",
 480                    op->o_ndn.bv_val ? op->o_ndn.bv_val : "",
 481                    accessmask2str( *mask, accessmaskbuf ) ));
 482 #else
 483         Debug( LDAP_DEBUG_ACL,
 484                 "=> acl_mask: access to entry \"%s\", attr \"%s\" requested\n",
 485                 e->e_dn, attr, 0 );
 486
 487         Debug( LDAP_DEBUG_ACL,
 488                 "=> acl_mask: to %s by \"%s\", (%s) \n",
 489                 val ? "value" : "all values",
 490                 op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
 491                 accessmask2str( *mask, accessmaskbuf ) );
 492 #endif
 493
 494         for ( i = 1, b = a->acl_access; b != NULL; b = b->a_next, i++ ) {
 495                 slap_mask_t oldmask, modmask;
 496
 497                 ACL_INVALIDATE( modmask );
 498
 499                 /* AND <who> clauses */
 500                 if ( b->a_dn_pat.bv_len != 0 ) {
 501 #ifdef NEW_LOGGING
 502                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 503                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 504                                    conn->c_connid, b->a_dn_pat.bv_val ));
 505 #else
 506                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
 507                                 b->a_dn_pat.bv_val, 0, 0);
 508 #endif
 509                         /*
 510                          * if access applies to the entry itself, and the
 511                          * user is bound as somebody in the same namespace as
 512                          * the entry, OR the given dn matches the dn pattern
 513                          */
 514                         if ( b->a_dn_pat.bv_len == sizeof("anonymous") -1 &&
 515                             strcmp( b->a_dn_pat.bv_val, "anonymous" ) == 0 ) {
 516                                 if (op->o_ndn.bv_len != 0 ) {
 517                                         continue;
 518                                 }
 519
 520                         } else if ( b->a_dn_pat.bv_len == sizeof("users") - 1 &&
 521                             strcmp( b->a_dn_pat.bv_val, "users" ) == 0 ) {
 522                                 if (op->o_ndn.bv_len == 0 ) {
 523                                         continue;
 524                                 }
 525
 526                         } else if ( b->a_dn_pat.bv_len == sizeof("self") - 1 &&
 527                             strcmp( b->a_dn_pat.bv_val, "self" ) == 0 ) {
 528                                 if( op->o_ndn.bv_len == 0 ) {
 529                                         continue;
 530                                 }
 531
 532                                 if ( e->e_dn == NULL || strcmp( e->e_ndn, op->o_ndn.bv_val ) != 0 ) {
 533                                         continue;
 534                                 }
 535
 536                         } else if ( b->a_dn_style == ACL_STYLE_REGEX ) {
 537                                 if ( b->a_dn_pat.bv_len != 1 ||
 538                                     strcmp( b->a_dn_pat.bv_val, "*" ) != 0 ) {
 539                                         int ret = regex_matches( b->a_dn_pat.bv_val,
 540                                                 op->o_ndn.bv_val, e->e_ndn, matches );
 541
 542                                         if( ret == 0 ) {
 543                                                 continue;
 544                                         }
 545                                 }
 546
 547                         } else {
 548                                 if ( e->e_dn == NULL )
 549                                         continue;
 550
 551                                 patlen = b->a_dn_pat.bv_len;
 552                                 odnlen = op->o_ndn.bv_len;
 553                                 if ( odnlen < patlen )
 554                                         continue;
 555
 556                                 if ( b->a_dn_style == ACL_STYLE_BASE ) {
 557                                         /* base dn -- entire object DN must match */
 558                                         if ( odnlen != patlen )
 559                                                 continue;
 560
 561                                 } else if ( b->a_dn_style == ACL_STYLE_ONE ) {
 562                                         int rdnlen = -1;
 563
 564                                         if ( odnlen <= patlen )
 565                                                 continue;
 566
 567                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 568                                                 continue;
 569
 570                                         rdnlen = dn_rdnlen( NULL, &op->o_ndn );
 571                                         if ( rdnlen != odnlen - patlen - 1 )
 572                                                 continue;
 573
 574                                 } else if ( b->a_dn_style == ACL_STYLE_SUBTREE ) {
 575                                         if ( odnlen > patlen && ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) ) )
 576                                                 continue;
 577
 578                                 } else if ( b->a_dn_style == ACL_STYLE_CHILDREN ) {
 579                                         if ( odnlen <= patlen )
 580                                                 continue;
 581                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 582                                                 continue;
 583                                 }
 584
 585                                 if ( strcmp( b->a_dn_pat.bv_val, op->o_ndn.bv_val + odnlen - patlen ) != 0 )
 586                                         continue;
 587
 588                         }
 589                 }
 590
 591                 if ( b->a_sockurl_pat != NULL ) {
 592 #ifdef NEW_LOGGING
 593                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 594                                    "acl_mask: conn %d  check a_sockurl_pat: %s\n",
 595                                    conn->c_connid, b->a_sockurl_pat ));
 596 #else
 597                         Debug( LDAP_DEBUG_ACL, "<= check a_sockurl_pat: %s\n",
 598                                 b->a_sockurl_pat, 0, 0 );
 599 #endif
 600
 601                         if ( strcmp( b->a_sockurl_pat, "*" ) != 0) {
 602                                 if ( b->a_sockurl_style == ACL_STYLE_REGEX) {
 603                                         if (!regex_matches( b->a_sockurl_pat, conn->c_listener_url,
 604                                                         e->e_ndn, matches ) )
 605                                         {
 606                                                 continue;
 607                                         }
 608                                 } else {
 609                                         if ( strcasecmp( b->a_sockurl_pat, conn->c_listener_url ) == 0 )
 610                                                 continue;
 611                                 }
 612                         }
 613                 }
 614
 615                 if ( b->a_domain_pat != NULL ) {
 616 #ifdef NEW_LOGGING
 617                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 618                                    "acl_mask: conn %d  check a_domain_pat: %s\n",
 619                                    conn->c_connid, b->a_domain_pat ));
 620 #else
 621                         Debug( LDAP_DEBUG_ACL, "<= check a_domain_pat: %s\n",
 622                                 b->a_domain_pat, 0, 0 );
 623 #endif
 624                         if ( strcmp( b->a_domain_pat, "*" ) != 0) {
 625                                 if ( b->a_domain_style == ACL_STYLE_REGEX) {
 626                                         if (!regex_matches( b->a_domain_pat, conn->c_peer_domain,
 627                                                         e->e_ndn, matches ) )
 628                                         {
 629                                                 continue;
 630                                         }
 631                                 } else {
 632                                         if ( strcasecmp( b->a_domain_pat, conn->c_peer_domain ) == 0 )
 633                                                 continue;
 634                                 }
 635                         }
 636                 }
 637
 638                 if ( b->a_peername_pat != NULL ) {
 639 #ifdef NEW_LOGGING
 640                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 641                                    "acl_mask: conn %d  check a_perrname_path: %s\n",
 642                                    conn->c_connid, b->a_peername_pat ));
 643 #else
 644                         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
 645                                 b->a_peername_pat, 0, 0 );
 646 #endif
 647                         if ( strcmp( b->a_peername_pat, "*" ) != 0) {
 648                                 if ( b->a_peername_style == ACL_STYLE_REGEX) {
 649                                         if (!regex_matches( b->a_peername_pat, conn->c_peer_name,
 650                                                         e->e_ndn, matches ) )
 651                                         {
 652                                                 continue;
 653                                         }
 654                                 } else {
 655                                         if ( strcasecmp( b->a_peername_pat, conn->c_peer_name ) == 0 )
 656                                                 continue;
 657                                 }
 658                         }
 659                 }
 660
 661                 if ( b->a_sockname_pat != NULL ) {
 662 #ifdef NEW_LOGGING
 663                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 664                                    "acl_mask: conn %d  check a_sockname_path: %s\n",
 665                                    conn->c_connid, b->a_sockname_pat ));
 666 #else
 667                         Debug( LDAP_DEBUG_ACL, "<= check a_sockname_path: %s\n",
 668                                 b->a_sockname_pat, 0, 0 );
 669 #endif
 670                         if ( strcmp( b->a_sockname_pat, "*" ) != 0) {
 671                                 if ( b->a_sockname_style == ACL_STYLE_REGEX) {
 672                                         if (!regex_matches( b->a_sockname_pat, conn->c_sock_name,
 673                                                         e->e_ndn, matches ) )
 674                                         {
 675                                                 continue;
 676                                         }
 677                                 } else {
 678                                         if ( strcasecmp( b->a_sockname_pat, conn->c_sock_name ) == 0 )
 679                                                 continue;
 680                                 }
 681                         }
 682                 }
 683
 684                 if ( b->a_dn_at != NULL && op->o_ndn.bv_len != 0 ) {
 685                         Attribute       *at;
 686                         struct berval   bv;
 687                         int rc, match = 0;
 688                         const char *text;
 689                         const char *attr = b->a_dn_at->ad_cname.bv_val;
 690
 691                         assert( attr != NULL );
 692
 693 #ifdef NEW_LOGGING
 694                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 695                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 696                                    conn->c_connid, attr ));
 697 #else
 698                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n",
 699                                 attr, 0, 0);
 700 #endif
 701                         bv = op->o_ndn;
 702
 703                         /* see if asker is listed in dnattr */
 704                         for( at = attrs_find( e->e_attrs, b->a_dn_at );
 705                                 at != NULL;
 706                                 at = attrs_find( at->a_next, b->a_dn_at ) )
 707                         {
 708                                 if( value_find( b->a_dn_at, at->a_vals, &bv ) == 0 ) {
 709                                         /* found it */
 710                                         match = 1;
 711                                         break;
 712                                 }
 713                         }
 714
 715                         if( match ) {
 716                                 /* have a dnattr match. if this is a self clause then
 717                                  * the target must also match the op dn.
 718                                  */
 719                                 if ( b->a_dn_self ) {
 720                                         /* check if the target is an attribute. */
 721                                         if ( val == NULL )
 722                                                 continue;
 723                                         /* target is attribute, check if the attribute value
 724                                          * is the op dn.
 725                                          */
 726                                         rc = value_match( &match, b->a_dn_at,
 727                                                 b->a_dn_at->ad_type->sat_equality, 0,
 728                                                 val, &bv, &text );
 729                                         /* on match error or no match, fail the ACL clause */
 730                                         if (rc != LDAP_SUCCESS || match != 0 )
 731                                                 continue;
 732                                 }
 733                         } else {
 734                                 /* no dnattr match, check if this is a self clause */
 735                                 if ( ! b->a_dn_self )
 736                                         continue;
 737                                 /* this is a self clause, check if the target is an
 738                                  * attribute.
 739                                  */
 740                                 if ( val == NULL )
 741                                         continue;
 742                                 /* target is attribute, check if the attribute value
 743                                  * is the op dn.
 744                                  */
 745                                 rc = value_match( &match, b->a_dn_at,
 746                                         b->a_dn_at->ad_type->sat_equality, 0,
 747                                         val, &bv, &text );
 748
 749                                 /* on match error or no match, fail the ACL clause */
 750                                 if (rc != LDAP_SUCCESS || match != 0 )
 751                                         continue;
 752                         }
 753                 }
 754
 755                 if ( b->a_group_pat.bv_len && op->o_ndn.bv_len ) {
 756                         char buf[1024];
 757                         struct berval bv = { sizeof(buf) - 1, buf };
 758                         struct berval ndn = { 0, NULL };
 759                         int rc;
 760
 761                         /* b->a_group is an unexpanded entry name, expanded it should be an
 762                          * entry with objectclass group* and we test to see if odn is one of
 763                          * the values in the attribute group
 764                          */
 765                         /* see if asker is listed in dnattr */
 766                         if ( b->a_group_style == ACL_STYLE_REGEX ) {
 767                                 string_expand(&bv, b->a_group_pat.bv_val, e->e_ndn, matches);
 768                                 if ( dnNormalize2(NULL, &bv, &ndn) != LDAP_SUCCESS ) {
 769                                         /* did not expand to a valid dn */
 770                                         continue;
 771                                 }
 772                                 bv = ndn;
 773                         } else {
 774                                 bv = b->a_group_pat;
 775                         }
 776
 777                         rc = backend_group(be, conn, op, e, &bv, &op->o_ndn,
 778                                 b->a_group_oc, b->a_group_at);
 779                         if ( ndn.bv_val )
 780                                 free( ndn.bv_val );
 781                         if ( rc != 0 )
 782                         {
 783                                 continue;
 784                         }
 785                 }
 786
 787                 if ( b->a_set_pat.bv_len != 0 ) {
 788                         if (aci_match_set( &b->a_set_pat, be, e, conn, op, 0 ) == 0) {
 789                                 continue;
 790                         }
 791                 }
 792
 793                 if ( b->a_authz.sai_ssf ) {
 794 #ifdef NEW_LOGGING
 795                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 796                                    "acl_mask: conn %d  check a_authz.sai_ssf: ACL %u > OP %u\n",
 797                                    conn->c_connid, b->a_authz.sai_ssf, op->o_ssf ));
 798 #else
 799                         Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
 800                                 b->a_authz.sai_ssf, op->o_ssf, 0 );
 801 #endif
 802                         if ( b->a_authz.sai_ssf >  op->o_ssf ) {
 803                                 continue;
 804                         }
 805                 }
 806
 807                 if ( b->a_authz.sai_transport_ssf ) {
 808 #ifdef NEW_LOGGING
 809                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 810                                    "acl_mask: conn %d  check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 811                                    conn->c_connid, b->a_authz.sai_transport_ssf, op->o_transport_ssf ));
 812 #else
 813                         Debug( LDAP_DEBUG_ACL,
 814                                 "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 815                                 b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
 816 #endif
 817                         if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
 818                                 continue;
 819                         }
 820                 }
 821
 822                 if ( b->a_authz.sai_tls_ssf ) {
 823 #ifdef NEW_LOGGING
 824                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 825                                    "acl_mask: conn %d  check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 826                                    conn->c_connid, b->a_authz.sai_tls_ssf, op->o_tls_ssf ));
 827 #else
 828                         Debug( LDAP_DEBUG_ACL,
 829                                 "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 830                                 b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
 831 #endif
 832                         if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
 833                                 continue;
 834                         }
 835                 }
 836
 837                 if ( b->a_authz.sai_sasl_ssf ) {
 838 #ifdef NEW_LOGGING
 839                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 840                                    "acl_mask: conn %d check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 841                                    conn->c_connid, b->a_authz.sai_sasl_ssf, op->o_sasl_ssf ));
 842 #else
 843                         Debug( LDAP_DEBUG_ACL,
 844                                 "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 845                                 b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
 846 #endif
 847                         if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
 848                                 continue;
 849                         }
 850                 }
 851
 852 #ifdef SLAPD_ACI_ENABLED
 853                 if ( b->a_aci_at != NULL ) {
 854                         Attribute       *at;
 855                         slap_access_t grant, deny, tgrant, tdeny;
 856
 857                         /* this case works different from the others above.
 858                          * since aci's themselves give permissions, we need
 859                          * to first check b->a_access_mask, the ACL's access level.
 860                          */
 861
 862                         if( op->o_ndn.bv_len == 0 ) {
 863                                 continue;
 864                         }
 865
 866                         if ( e->e_dn == NULL ) {
 867                                 continue;
 868                         }
 869
 870                         /* first check if the right being requested
 871                          * is allowed by the ACL clause.
 872                          */
 873                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
 874                                 continue;
 875                         }
 876
 877                         /* get the aci attribute */
 878                         at = attr_find( e->e_attrs, b->a_aci_at );
 879                         if ( at == NULL ) {
 880                                 continue;
 881                         }
 882
 883                         /* start out with nothing granted, nothing denied */
 884                         ACL_INIT(tgrant);
 885                         ACL_INIT(tdeny);
 886
 887                         /* the aci is an multi-valued attribute.  The
 888                          * rights are determined by OR'ing the individual
 889                          * rights given by the acis.
 890                          */
 891                         for ( i = 0; at->a_vals[i] != NULL; i++ ) {
 892                                 if (aci_mask( be, conn, op,
 893                                         e, desc, val, at->a_vals[i],
 894                                         matches, &grant, &deny ) != 0)
 895                                 {
 896                                         tgrant |= grant;
 897                                         tdeny |= deny;
 898                                 }
 899                         }
 900
 901                         /* remove anything that the ACL clause does not allow */
 902                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
 903                         tdeny &= ACL_PRIV_MASK;
 904
 905                         /* see if we have anything to contribute */
 906                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
 907                                 continue;
 908                         }
 909
 910                         /* this could be improved by changing acl_mask so that it can deal with
 911                          * by clauses that return grant/deny pairs.  Right now, it does either
 912                          * additive or subtractive rights, but not both at the same time.  So,
 913                          * we need to combine the grant/deny pair into a single rights mask in
 914                          * a smart way:  if either grant or deny is "empty", then we use the
 915                          * opposite as is, otherwise we remove any denied rights from the grant
 916                          * rights mask and construct an additive mask.
 917                          */
 918                         if (ACL_IS_INVALID(tdeny)) {
 919                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
 920
 921                         } else if (ACL_IS_INVALID(tgrant)) {
 922                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
 923
 924                         } else {
 925                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
 926                         }
 927
 928                 } else
 929 #endif
 930                 {
 931                         modmask = b->a_access_mask;
 932                 }
 933
 934 #ifdef NEW_LOGGING
 935                 LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 936                            "acl_mask: conn %d  [%d] applying %s (%s)\n",
 937                            conn->c_connid, i, accessmask2str( modmask, accessmaskbuf),
 938                            b->a_type == ACL_CONTINUE ? "continue" : b->a_type == ACL_BREAK
 939                            ? "break" : "stop" ));
 940 #else
 941                 Debug( LDAP_DEBUG_ACL,
 942                         "<= acl_mask: [%d] applying %s (%s)\n",
 943                         i, accessmask2str( modmask, accessmaskbuf ),
 944                         b->a_type == ACL_CONTINUE
 945                                 ? "continue"
 946                                 : b->a_type == ACL_BREAK
 947                                         ? "break"
 948                                         : "stop" );
 949 #endif
 950                 /* save old mask */
 951                 oldmask = *mask;
 952
 953                 if( ACL_IS_ADDITIVE(modmask) ) {
 954                         /* add privs */
 955                         ACL_PRIV_SET( *mask, modmask );
 956
 957                         /* cleanup */
 958                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 959
 960                 } else if( ACL_IS_SUBTRACTIVE(modmask) ) {
 961                         /* substract privs */
 962                         ACL_PRIV_CLR( *mask, modmask );
 963
 964                         /* cleanup */
 965                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 966
 967                 } else {
 968                         /* assign privs */
 969                         *mask = modmask;
 970                 }
 971
 972 #ifdef NEW_LOGGING
 973                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
 974                            "acl_mask: conn %d  [%d] mask: %s\n",
 975                            conn->c_connid, i, accessmask2str( *mask, accessmaskbuf) ));
 976 #else
 977                 Debug( LDAP_DEBUG_ACL,
 978                         "<= acl_mask: [%d] mask: %s\n",
 979                         i, accessmask2str(*mask, accessmaskbuf), 0 );
 980 #endif
 981
 982                 if( b->a_type == ACL_CONTINUE ) {
 983                         continue;
 984
 985                 } else if ( b->a_type == ACL_BREAK ) {
 986                         return ACL_BREAK;
 987
 988                 } else {
 989                         return ACL_STOP;
 990                 }
 991         }
 992
 993         /* implicit "by * none" clause */
 994         ACL_INIT(*mask);
 995
 996 #ifdef NEW_LOGGING
 997         LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 998                    "acl_mask: conn %d  no more <who> clauses, returning %d (stop)\n",
 999                    conn->c_connid, accessmask2str( *mask, accessmaskbuf) ));
1000 #else
1001         Debug( LDAP_DEBUG_ACL,
1002                 "<= acl_mask: no more <who> clauses, returning %s (stop)\n",
1003                 accessmask2str(*mask, accessmaskbuf), 0, 0 );
1004 #endif
1005         return ACL_STOP;
1006 }
1007
1008 /*
1009  * acl_check_modlist - check access control on the given entry to see if
1010  * it allows the given modifications by the user associated with op.
1011  * returns      1       if mods allowed ok
1012  *                      0       mods not allowed
1013  */
1014
1015 int
1016 acl_check_modlist(
1017     Backend     *be,
1018     Connection  *conn,
1019     Operation   *op,
1020     Entry       *e,
1021     Modifications       *mlist
1022 )
1023 {
1024         struct berval *bv;
1025
1026         assert( be != NULL );
1027
1028         /* short circuit root database access */
1029         if ( be_isroot( be, &op->o_ndn ) ) {
1030 #ifdef NEW_LOGGING
1031                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
1032                            "acl_check_modlist: conn %d  access granted to root user\n",
1033                            conn->c_connid ));
1034 #else
1035                 Debug( LDAP_DEBUG_ACL,
1036                         "<= acl_access_allowed: granted to database root\n",
1037                     0, 0, 0 );
1038 #endif
1039                 return 1;
1040         }
1041
1042         /* use backend default access if no backend acls */
1043         if( be != NULL && be->be_acl == NULL ) {
1044 #ifdef NEW_LOGGING
1045                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1046                            "acl_check_modlist: conn %d  backend default %s access %s to \"%s\"\n",
1047                            conn->c_connid, access2str( ACL_WRITE ),
1048                            be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn ));
1049 #else
1050                 Debug( LDAP_DEBUG_ACL,
1051                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
1052                         access2str( ACL_WRITE ),
1053                         be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn );
1054 #endif
1055                 return be->be_dfltaccess >= ACL_WRITE;
1056
1057 #ifdef notdef
1058         /* be is always non-NULL */
1059         /* use global default access if no global acls */
1060         } else if ( be == NULL && global_acl == NULL ) {
1061 #ifdef NEW_LOGGING
1062                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1063                            "acl_check_modlist: conn %d  global default %s access %s to \"%s\"\n",
1064                            conn->c_connid, access2str( ACL_WRITE ),
1065                            global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn ));
1066 #else
1067                 Debug( LDAP_DEBUG_ACL,
1068                         "=> access_allowed: global default %s access %s to \"%s\"\n",
1069                         access2str( ACL_WRITE ),
1070                         global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn );
1071 #endif
1072                 return global_default_access >= ACL_WRITE;
1073 #endif
1074         }
1075
1076         for ( ; mlist != NULL; mlist = mlist->sml_next ) {
1077                 /*
1078                  * no-user-modification operational attributes are ignored
1079                  * by ACL_WRITE checking as any found here are not provided
1080                  * by the user
1081                  */
1082                 if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
1083 #ifdef NEW_LOGGING
1084                         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1085                                    "acl_check_modlist: conn %d  no-user-mod %s: modify access granted\n",
1086                                    conn->c_connid, mlist->sml_desc->ad_cname.bv_val ));
1087 #else
1088                         Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
1089                                 " modify access granted\n",
1090                                 mlist->sml_desc->ad_cname.bv_val, 0, 0 );
1091 #endif
1092                         continue;
1093                 }
1094
1095                 switch ( mlist->sml_op ) {
1096                 case LDAP_MOD_REPLACE:
1097                 case LDAP_MOD_ADD:
1098                         if ( mlist->sml_bvalues == NULL ) {
1099                                 break;
1100                         }
1101                         for ( bv = mlist->sml_bvalues; bv->bv_val != NULL; bv++ ) {
1102                                 if ( ! access_allowed( be, conn, op, e,
1103                                         mlist->sml_desc, bv, ACL_WRITE ) )
1104                                 {
1105                                         return( 0 );
1106                                 }
1107                         }
1108                         break;
1109
1110                 case LDAP_MOD_DELETE:
1111                         if ( mlist->sml_bvalues == NULL ) {
1112                                 if ( ! access_allowed( be, conn, op, e,
1113                                         mlist->sml_desc, NULL, ACL_WRITE ) )
1114                                 {
1115                                         return( 0 );
1116                                 }
1117                                 break;
1118                         }
1119                         for ( bv = mlist->sml_bvalues; bv->bv_val != NULL; bv++ ) {
1120                                 if ( ! access_allowed( be, conn, op, e,
1121                                         mlist->sml_desc, bv, ACL_WRITE ) )
1122                                 {
1123                                         return( 0 );
1124                                 }
1125                         }
1126                         break;
1127                 }
1128         }
1129
1130         return( 1 );
1131 }
1132
1133 static char *
1134 aci_bvstrdup( struct berval *bv )
1135 {
1136         char *s;
1137
1138         s = (char *)ch_malloc(bv->bv_len + 1);
1139         if (s != NULL) {
1140                 AC_MEMCPY(s, bv->bv_val, bv->bv_len);
1141                 s[bv->bv_len] = 0;
1142         }
1143         return(s);
1144 }
1145
1146 #ifdef SLAPD_ACI_ENABLED
1147 static int
1148 aci_strbvcmp(
1149         const char *s,
1150         struct berval *bv )
1151 {
1152         int res, len;
1153
1154         res = strncasecmp( s, bv->bv_val, bv->bv_len );
1155         if (res)
1156                 return(res);
1157         len = strlen(s);
1158         if (len > (int)bv->bv_len)
1159                 return(1);
1160         if (len < (int)bv->bv_len)
1161                 return(-1);
1162         return(0);
1163 }
1164 #endif
1165
1166 static int
1167 aci_get_part(
1168         struct berval *list,
1169         int ix,
1170         char sep,
1171         struct berval *bv )
1172 {
1173         int len;
1174         char *p;
1175
1176         if (bv) {
1177                 bv->bv_len = 0;
1178                 bv->bv_val = NULL;
1179         }
1180         len = list->bv_len;
1181         p = list->bv_val;
1182         while (len >= 0 && --ix >= 0) {
1183                 while (--len >= 0 && *p++ != sep) ;
1184         }
1185         while (len >= 0 && *p == ' ') {
1186                 len--;
1187                 p++;
1188         }
1189         if (len < 0)
1190                 return(-1);
1191
1192         if (!bv)
1193                 return(0);
1194
1195         bv->bv_val = p;
1196         while (--len >= 0 && *p != sep) {
1197                 bv->bv_len++;
1198                 p++;
1199         }
1200         while (bv->bv_len > 0 && *--p == ' ')
1201                 bv->bv_len--;
1202         return(bv->bv_len);
1203 }
1204
1205 BVarray
1206 aci_set_gather (void *cookie, char *name, struct berval *attr)
1207 {
1208         AciSetCookie *cp = cookie;
1209         BVarray bvals = NULL;
1210         struct berval bv, ndn;
1211
1212         /* this routine needs to return the bervals instead of
1213          * plain strings, since syntax is not known.  It should
1214          * also return the syntax or some "comparison cookie".
1215          */
1216
1217         bv.bv_val = name;
1218         bv.bv_len = strlen( name );
1219         if (dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS) {
1220                 const char *text;
1221                 AttributeDescription *desc = NULL;
1222                 if (slap_bv2ad(attr, &desc, &text) == LDAP_SUCCESS) {
1223                         backend_attribute(cp->be, NULL, NULL,
1224                                 cp->e, &ndn, desc, &bvals);
1225                 }
1226                 free(ndn.bv_val);
1227         }
1228         return(bvals);
1229 }
1230
1231 static int
1232 aci_match_set (
1233         struct berval *subj,
1234     Backend *be,
1235     Entry *e,
1236     Connection *conn,
1237     Operation *op,
1238     int setref
1239 )
1240 {
1241         struct berval set = { 0, NULL };
1242         int rc = 0;
1243         AciSetCookie cookie;
1244
1245         if (setref == 0) {
1246                 ber_dupbv( &set, subj );
1247         } else {
1248                 struct berval subjdn, ndn = { 0, NULL };
1249                 struct berval setat;
1250                 BVarray bvals;
1251                 const char *text;
1252                 AttributeDescription *desc = NULL;
1253
1254                 /* format of string is "entry/setAttrName" */
1255                 if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
1256                         return(0);
1257                 } else {
1258                         /* FIXME: If dnNormalize was based on ldap_bv2dn
1259                          * instead of ldap_str2dn and would honor the bv_len
1260                          * we could skip this step and not worry about the
1261                          * unterminated string.
1262                          */
1263                         char *s = ch_malloc(subjdn.bv_len + 1);
1264                         AC_MEMCPY(s, subjdn.bv_val, subjdn.bv_len);
1265                         subjdn.bv_val = s;
1266                 }
1267
1268                 if ( aci_get_part(subj, 1, '/', &setat) < 0 ) {
1269                         setat.bv_val = SLAPD_ACI_SET_ATTR;
1270                         setat.bv_len = sizeof(SLAPD_ACI_SET_ATTR)-1;
1271                 }
1272                 if ( setat.bv_val != NULL ) {
1273                         if ( dnNormalize2(NULL, &subjdn, &ndn) == LDAP_SUCCESS
1274                                 && slap_bv2ad(&setat, &desc, &text) == LDAP_SUCCESS )
1275                         {
1276                                 backend_attribute(be, NULL, NULL, e,
1277                                         &ndn, desc, &bvals);
1278                                 if ( bvals != NULL ) {
1279                                         if ( bvals[0].bv_val != NULL ) {
1280                                                 int i;
1281                                                 set = bvals[0];
1282                                                 bvals[0].bv_val = NULL;
1283                                                 for (i=1;bvals[i].bv_val;i++);
1284                                                 bvals[0].bv_val = bvals[i-1].bv_val;
1285                                                 bvals[i-1].bv_val = NULL;
1286                                         }
1287                                         bvarray_free(bvals);
1288                                 }
1289                         }
1290                         if (ndn.bv_val)
1291                                 free(ndn.bv_val);
1292                 }
1293                 ch_free(subjdn.bv_val);
1294         }
1295
1296         if (set.bv_val != NULL) {
1297                 cookie.be = be;
1298                 cookie.e = e;
1299                 cookie.conn = conn;
1300                 cookie.op = op;
1301                 rc = (slap_set_filter(aci_set_gather, &cookie, &set,
1302                         op->o_ndn.bv_val, e->e_ndn, NULL) > 0);
1303                 ch_free(set.bv_val);
1304         }
1305         return(rc);
1306 }
1307
1308 #ifdef SLAPD_ACI_ENABLED
1309 static int
1310 aci_list_map_rights(
1311         struct berval *list )
1312 {
1313         struct berval bv;
1314         slap_access_t mask;
1315         int i;
1316
1317         ACL_INIT(mask);
1318         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1319                 if (bv.bv_len <= 0)
1320                         continue;
1321                 switch (*bv.bv_val) {
1322                 case 'c':
1323                         ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
1324                         break;
1325                 case 's':
1326                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
1327                          * the right 's' to mean "set", but in the examples states
1328                          * that the right 's' means "search".  The latter definition
1329                          * is used here.
1330                          */
1331                         ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
1332                         break;
1333                 case 'r':
1334                         ACL_PRIV_SET(mask, ACL_PRIV_READ);
1335                         break;
1336                 case 'w':
1337                         ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
1338                         break;
1339                 case 'x':
1340                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
1341                          * define any equivalent to the AUTH right, so I've just used
1342                          * 'x' for now.
1343                          */
1344                         ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
1345                         break;
1346                 default:
1347                         break;
1348                 }
1349
1350         }
1351         return(mask);
1352 }
1353
1354 static int
1355 aci_list_has_attr(
1356         struct berval *list,
1357         const char *attr,
1358         struct berval *val )
1359 {
1360         struct berval bv, left, right;
1361         int i;
1362
1363         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1364                 if (aci_get_part(&bv, 0, '=', &left) < 0
1365                         || aci_get_part(&bv, 1, '=', &right) < 0)
1366                 {
1367                         if (aci_strbvcmp(attr, &bv) == 0)
1368                                 return(1);
1369                 } else if (val == NULL) {
1370                         if (aci_strbvcmp(attr, &left) == 0)
1371                                 return(1);
1372                 } else {
1373                         if (aci_strbvcmp(attr, &left) == 0) {
1374                                 /* this is experimental code that implements a
1375                                  * simple (prefix) match of the attribute value.
1376                                  * the ACI draft does not provide for aci's that
1377                                  * apply to specific values, but it would be
1378                                  * nice to have.  If the <attr> part of an aci's
1379                                  * rights list is of the form <attr>=<value>,
1380                                  * that means the aci applies only to attrs with
1381                                  * the given value.  Furthermore, if the attr is
1382                                  * of the form <attr>=<value>*, then <value> is
1383                                  * treated as a prefix, and the aci applies to
1384                                  * any value with that prefix.
1385                                  *
1386                                  * Ideally, this would allow r.e. matches.
1387                                  */
1388                                 if (aci_get_part(&right, 0, '*', &left) < 0
1389                                         || right.bv_len <= left.bv_len)
1390                                 {
1391                                         if (aci_strbvcmp(val->bv_val, &right) == 0)
1392                                                 return(1);
1393                                 } else if (val->bv_len >= left.bv_len) {
1394                                         if (strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0)
1395                                                 return(1);
1396                                 }
1397                         }
1398                 }
1399         }
1400         return(0);
1401 }
1402
1403 static slap_access_t
1404 aci_list_get_attr_rights(
1405         struct berval *list,
1406         const char *attr,
1407         struct berval *val )
1408 {
1409     struct berval bv;
1410     slap_access_t mask;
1411     int i;
1412
1413         /* loop through each rights/attr pair, skip first part (action) */
1414         ACL_INIT(mask);
1415         for (i = 1; aci_get_part(list, i + 1, ';', &bv) >= 0; i += 2) {
1416                 if (aci_list_has_attr(&bv, attr, val) == 0)
1417                         continue;
1418                 if (aci_get_part(list, i, ';', &bv) < 0)
1419                         continue;
1420                 mask |= aci_list_map_rights(&bv);
1421         }
1422         return(mask);
1423 }
1424
1425 static int
1426 aci_list_get_rights(
1427         struct berval *list,
1428         const char *attr,
1429         struct berval *val,
1430         slap_access_t *grant,
1431         slap_access_t *deny )
1432 {
1433     struct berval perm, actn;
1434     slap_access_t *mask;
1435     int i, found;
1436
1437         if (attr == NULL || *attr == 0 || strcasecmp(attr, "entry") == 0) {
1438                 attr = "[entry]";
1439         }
1440
1441         found = 0;
1442         ACL_INIT(*grant);
1443         ACL_INIT(*deny);
1444         /* loop through each permissions clause */
1445         for (i = 0; aci_get_part(list, i, '$', &perm) >= 0; i++) {
1446                 if (aci_get_part(&perm, 0, ';', &actn) < 0)
1447                         continue;
1448                 if (aci_strbvcmp( "grant", &actn ) == 0) {
1449                         mask = grant;
1450                 } else if (aci_strbvcmp( "deny", &actn ) == 0) {
1451                         mask = deny;
1452                 } else {
1453                         continue;
1454                 }
1455
1456                 found = 1;
1457                 *mask |= aci_list_get_attr_rights(&perm, attr, val);
1458                 *mask |= aci_list_get_attr_rights(&perm, "[all]", NULL);
1459         }
1460         return(found);
1461 }
1462
1463 static int
1464 aci_group_member (
1465         struct berval *subj,
1466         struct berval *defgrpoc,
1467         struct berval *defgrpat,
1468     Backend             *be,
1469     Entry               *e,
1470     Connection          *conn,
1471     Operation           *op,
1472         regmatch_t      *matches
1473 )
1474 {
1475         struct berval bv;
1476         char *subjdn;
1477         struct berval grpoc;
1478         struct berval grpat;
1479         ObjectClass *grp_oc = NULL;
1480         AttributeDescription *grp_ad = NULL;
1481         const char *text;
1482         int rc;
1483
1484         /* format of string is "group/objectClassValue/groupAttrName" */
1485         if (aci_get_part(subj, 0, '/', &bv) < 0) {
1486                 return(0);
1487         }
1488
1489         subjdn = aci_bvstrdup(&bv);
1490         if (subjdn == NULL) {
1491                 return(0);
1492         }
1493
1494         if (aci_get_part(subj, 1, '/', &grpoc) < 0) {
1495                 grpoc = *defgrpoc;
1496         }
1497
1498         if (aci_get_part(subj, 2, '/', &grpat) < 0) {
1499                 grpat = *defgrpat;
1500         }
1501
1502         rc = slap_bv2ad( &grpat, &grp_ad, &text );
1503         if( rc != LDAP_SUCCESS ) {
1504                 rc = 0;
1505                 goto done;
1506         }
1507         rc = 0;
1508
1509         grp_oc = oc_bvfind( &grpoc );
1510
1511         if (grp_oc != NULL && grp_ad != NULL ) {
1512                 struct berval ndn;
1513                 bv.bv_val = (char *)ch_malloc(1024);
1514                 bv.bv_len = 1024;
1515                 string_expand(&bv, subjdn, e->e_ndn, matches);
1516                 if ( dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS ) {
1517                         rc = (backend_group(be, conn, op, e, &ndn, &op->o_ndn, grp_oc, grp_ad) == 0);
1518                         free( ndn.bv_val );
1519                 }
1520                 ch_free(bv.bv_val);
1521         }
1522
1523 done:
1524         ch_free(subjdn);
1525         return(rc);
1526 }
1527
1528 static struct berval GroupClass = {
1529         sizeof(SLAPD_GROUP_CLASS)-1, SLAPD_GROUP_CLASS };
1530 static struct berval GroupAttr = {
1531         sizeof(SLAPD_GROUP_ATTR)-1, SLAPD_GROUP_ATTR };
1532 static struct berval RoleClass = {
1533         sizeof(SLAPD_ROLE_CLASS)-1, SLAPD_ROLE_CLASS };
1534 static struct berval RoleAttr = {
1535         sizeof(SLAPD_ROLE_ATTR)-1, SLAPD_ROLE_ATTR };
1536
1537 static int
1538 aci_mask(
1539     Backend                     *be,
1540     Connection          *conn,
1541     Operation           *op,
1542     Entry                       *e,
1543         AttributeDescription *desc,
1544     struct berval       *val,
1545     struct berval       *aci,
1546         regmatch_t              *matches,
1547         slap_access_t   *grant,
1548         slap_access_t   *deny
1549 )
1550 {
1551     struct berval bv, perms, sdn;
1552         int rc;
1553         char *attr = desc->ad_cname.bv_val;
1554
1555         assert( attr != NULL );
1556
1557         /* parse an aci of the form:
1558                 oid#scope#action;rights;attr;rights;attr$action;rights;attr;rights;attr#dnType#subjectDN
1559
1560            See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
1561            a full description of the format for this attribute.
1562
1563            For now, this routine only supports scope=entry.
1564          */
1565
1566         /* check that the aci has all 5 components */
1567         if (aci_get_part(aci, 4, '#', NULL) < 0)
1568                 return(0);
1569
1570         /* check that the aci family is supported */
1571         if (aci_get_part(aci, 0, '#', &bv) < 0)
1572                 return(0);
1573
1574         /* check that the scope is "entry" */
1575         if (aci_get_part(aci, 1, '#', &bv) < 0
1576                 || aci_strbvcmp( "entry", &bv ) != 0)
1577         {
1578                 return(0);
1579         }
1580
1581         /* get the list of permissions clauses, bail if empty */
1582         if (aci_get_part(aci, 2, '#', &perms) <= 0)
1583                 return(0);
1584
1585         /* check if any permissions allow desired access */
1586         if (aci_list_get_rights(&perms, attr, val, grant, deny) == 0)
1587                 return(0);
1588
1589         /* see if we have a DN match */
1590         if (aci_get_part(aci, 3, '#', &bv) < 0)
1591                 return(0);
1592
1593         if (aci_get_part(aci, 4, '#', &sdn) < 0)
1594                 return(0);
1595
1596         if (aci_strbvcmp( "access-id", &bv ) == 0) {
1597                 struct berval ndn;
1598                 rc = 1;
1599                 if ( dnNormalize2(NULL, &sdn, &ndn) == LDAP_SUCCESS ) {
1600                         if (strcasecmp(op->o_ndn.bv_val, ndn.bv_val) != 0)
1601                                 rc = 0;
1602                         free(ndn.bv_val);
1603                 }
1604                 return(rc);
1605         }
1606
1607         if (aci_strbvcmp( "self", &bv ) == 0) {
1608                 if (strcmp(op->o_ndn.bv_val, e->e_ndn) == 0)
1609                         return(1);
1610
1611         } else if (aci_strbvcmp( "dnattr", &bv ) == 0) {
1612                 char *dnattr = aci_bvstrdup(&sdn);
1613                 Attribute *at;
1614                 AttributeDescription *ad = NULL;
1615                 const char *text;
1616
1617                 rc = slap_str2ad( dnattr, &ad, &text );
1618                 ch_free( dnattr );
1619
1620                 if( rc != LDAP_SUCCESS ) {
1621                         return 0;
1622                 }
1623
1624                 rc = 0;
1625
1626                 bv = op->o_ndn;
1627
1628                 for(at = attrs_find( e->e_attrs, ad );
1629                         at != NULL;
1630                         at = attrs_find( at->a_next, ad ) )
1631                 {
1632                         if (value_find( ad, at->a_vals, &bv) == 0 ) {
1633                                 rc = 1;
1634                                 break;
1635                         }
1636                 }
1637
1638                 return rc;
1639
1640
1641         } else if (aci_strbvcmp( "group", &bv ) == 0) {
1642                 if (aci_group_member(&sdn, &GroupClass, &GroupAttr, be, e, conn, op, matches))
1643                         return(1);
1644
1645         } else if (aci_strbvcmp( "role", &bv ) == 0) {
1646                 if (aci_group_member(&sdn, &RoleClass, &RoleAttr, be, e, conn, op, matches))
1647                         return(1);
1648
1649         } else if (aci_strbvcmp( "set", &bv ) == 0) {
1650                 if (aci_match_set(&sdn, be, e, conn, op, 0))
1651                         return(1);
1652
1653         } else if (aci_strbvcmp( "set-ref", &bv ) == 0) {
1654                 if (aci_match_set(&sdn, be, e, conn, op, 1))
1655                         return(1);
1656
1657         }
1658
1659         return(0);
1660 }
1661
1662 #endif  /* SLAPD_ACI_ENABLED */
1663
1664 static void
1665 string_expand(
1666         struct berval *bv,
1667         char *pat,
1668         char *match,
1669         regmatch_t *matches)
1670 {
1671         ber_len_t       size;
1672         char   *sp;
1673         char   *dp;
1674         int     flag;
1675
1676         size = 0;
1677         bv->bv_val[0] = '\0';
1678         bv->bv_len--; /* leave space for lone $ */
1679
1680         flag = 0;
1681         for ( dp = bv->bv_val, sp = pat; size < bv->bv_len && *sp ; sp++) {
1682                 /* did we previously see a $ */
1683                 if (flag) {
1684                         if (*sp == '$') {
1685                                 *dp++ = '$';
1686                                 size++;
1687                         } else if (*sp >= '0' && *sp <= '9' ) {
1688                                 int     n;
1689                                 int     i;
1690                                 int     l;
1691
1692                                 n = *sp - '0';
1693                                 *dp = '\0';
1694                                 i = matches[n].rm_so;
1695                                 l = matches[n].rm_eo;
1696                                 for ( ; size < bv->bv_len && i < l; size++, i++ ) {
1697                                         *dp++ = match[i];
1698                                         size++;
1699                                 }
1700                                 *dp = '\0';
1701                         }
1702                         flag = 0;
1703                 } else {
1704                         if (*sp == '$') {
1705                                 flag = 1;
1706                         } else {
1707                                 *dp++ = *sp;
1708                                 size++;
1709                         }
1710                 }
1711         }
1712
1713         if (flag) {
1714                 /* must have ended with a single $ */
1715                 *dp++ = '$';
1716                 size++;
1717         }
1718
1719         *dp = '\0';
1720         bv->bv_len = size;
1721
1722 #ifdef NEW_LOGGING
1723         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1724                    "string_expand:  pattern = %s\n", pat ));
1725         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1726                    "string_expand:  expanded = %s\n", bv->bv_val ));
1727 #else
1728         Debug( LDAP_DEBUG_TRACE, "=> string_expand: pattern:  %s\n", pat, 0, 0 );
1729         Debug( LDAP_DEBUG_TRACE, "=> string_expand: expanded: %s\n", bv->bv_val, 0, 0 );
1730 #endif
1731 }
1732
1733 static int
1734 regex_matches(
1735         char *pat,                              /* pattern to expand and match against */
1736         char *str,                              /* string to match against pattern */
1737         char *buf,                              /* buffer with $N expansion variables */
1738         regmatch_t *matches             /* offsets in buffer for $N expansion variables */
1739 )
1740 {
1741         regex_t re;
1742         char newbuf[512];
1743         struct berval bv = {sizeof(newbuf), newbuf};
1744         int     rc;
1745
1746         if(str == NULL) str = "";
1747
1748         string_expand(&bv, pat, buf, matches);
1749         if (( rc = regcomp(&re, newbuf, REG_EXTENDED|REG_ICASE))) {
1750                 char error[512];
1751                 regerror(rc, &re, error, sizeof(error));
1752
1753 #ifdef NEW_LOGGING
1754                 LDAP_LOG(( "aci", LDAP_LEVEL_ERR,
1755                            "regex_matches: compile( \"%s\", \"%s\") failed %s\n",
1756                            pat, str, error ));
1757 #else
1758                 Debug( LDAP_DEBUG_TRACE,
1759                     "compile( \"%s\", \"%s\") failed %s\n",
1760                         pat, str, error );
1761 #endif
1762                 return( 0 );
1763         }
1764
1765         rc = regexec(&re, str, 0, NULL, 0);
1766         regfree( &re );
1767
1768 #ifdef NEW_LOGGING
1769         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1770                    "regex_matches: string:   %s\n", str ));
1771         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1772                    "regex_matches: rc:  %d  %s\n",
1773                    rc, rc ? "matches" : "no matches" ));
1774 #else
1775         Debug( LDAP_DEBUG_TRACE,
1776             "=> regex_matches: string:   %s\n", str, 0, 0 );
1777         Debug( LDAP_DEBUG_TRACE,
1778             "=> regex_matches: rc: %d %s\n",
1779                 rc, !rc ? "matches" : "no matches", 0 );
1780 #endif
1781         return( !rc );
1782 }
1783