git.sur5r.net Git - openldap/blob - servers/slapd/acl.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/regex.h>
  13 #include <ac/socket.h>
  14 #include <ac/string.h>
  15
  16 #include "slap.h"
  17 #include "sets.h"
  18
  19 static AccessControl * acl_get(
  20         AccessControl *ac, int *count,
  21         Backend *be, Operation *op,
  22         Entry *e,
  23         AttributeDescription *desc,
  24         int nmatches, regmatch_t *matches );
  25
  26 static slap_control_t acl_mask(
  27         AccessControl *ac, slap_mask_t *mask,
  28         Backend *be, Connection *conn, Operation *op,
  29         Entry *e,
  30         AttributeDescription *desc,
  31         struct berval *val,
  32         regmatch_t *matches );
  33
  34 #ifdef SLAPD_ACI_ENABLED
  35 static int aci_mask(
  36         Backend *be,
  37     Connection *conn,
  38         Operation *op,
  39         Entry *e,
  40         AttributeDescription *desc,
  41         struct berval *val,
  42         struct berval *aci,
  43         regmatch_t *matches,
  44         slap_access_t *grant,
  45         slap_access_t *deny );
  46 #endif
  47
  48 static int      regex_matches(
  49         char *pat, char *str, char *buf, regmatch_t *matches);
  50 static void     string_expand(
  51         struct berval *newbuf, char *pattern,
  52         char *match, regmatch_t *matches);
  53
  54 typedef struct AciSetCookie {
  55         Backend *be;
  56         Entry *e;
  57         Connection *conn;
  58         Operation *op;
  59 } AciSetCookie;
  60
  61 char **aci_set_gather (void *cookie, char *name, struct berval *attr);
  62 static int aci_match_set ( struct berval *subj, Backend *be,
  63     Entry *e, Connection *conn, Operation *op, int setref );
  64
  65 /*
  66  * access_allowed - check whether op->o_ndn is allowed the requested access
  67  * to entry e, attribute attr, value val.  if val is null, access to
  68  * the whole attribute is assumed (all values).
  69  *
  70  * This routine loops through all access controls and calls
  71  * acl_mask() on each applicable access control.
  72  * The loop exits when a definitive answer is reached or
  73  * or no more controls remain.
  74  *
  75  * returns:
  76  *              0       access denied
  77  *              1       access granted
  78  */
  79
  80 int
  81 access_allowed(
  82     Backend             *be,
  83     Connection          *conn,
  84     Operation           *op,
  85     Entry               *e,
  86         AttributeDescription    *desc,
  87     struct berval       *val,
  88     slap_access_t       access )
  89 {
  90         int                             count;
  91         AccessControl   *a;
  92 #ifdef LDAP_DEBUG
  93         char accessmaskbuf[ACCESSMASK_MAXLEN];
  94 #endif
  95         slap_mask_t mask;
  96         slap_control_t control;
  97         const char *attr;
  98         regmatch_t matches[MAXREMATCHES];
  99
 100         assert( e != NULL );
 101         assert( desc != NULL );
 102         assert( access > ACL_NONE );
 103
 104         attr = desc->ad_cname.bv_val;
 105
 106         assert( attr != NULL );
 107
 108 #ifdef NEW_LOGGING
 109         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 110                 "access_allowed: conn %d %s access to \"%s\" \"%s\" requested\n",
 111                 conn ? conn->c_connid : -1, access2str( access ), e->e_dn, attr ));
 112 #else
 113         Debug( LDAP_DEBUG_ACL,
 114                 "=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
 115             access2str( access ), e->e_dn, attr );
 116 #endif
 117
 118         if ( op == NULL ) {
 119                 /* no-op call */
 120                 return 1;
 121         }
 122
 123         if ( be == NULL ) be = &backends[0];
 124         assert( be != NULL );
 125
 126         /* grant database root access */
 127         if ( be != NULL && be_isroot( be, &op->o_ndn ) ) {
 128 #ifdef NEW_LOGGING
 129                 LDAP_LOG(( "acl", LDAP_LEVEL_INFO,
 130                        "access_allowed: conn %d root access granted\n",
 131                        conn->c_connid));
 132 #else
 133                 Debug( LDAP_DEBUG_ACL,
 134                     "<= root access granted\n",
 135                         0, 0, 0 );
 136 #endif
 137                 return 1;
 138         }
 139
 140         /*
 141          * no-user-modification operational attributes are ignored
 142          * by ACL_WRITE checking as any found here are not provided
 143          * by the user
 144          */
 145         if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 146                 && desc != slap_schema.si_ad_entry
 147                 && desc != slap_schema.si_ad_children )
 148         {
 149 #ifdef NEW_LOGGING
 150                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 151                        "access_allowed: conn %d NoUserMod Operational attribute: %s access granted\n",
 152                        conn->c_connid, attr ));
 153 #else
 154                 Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
 155                         " %s access granted\n",
 156                         attr, 0, 0 );
 157 #endif
 158                 return 1;
 159         }
 160
 161         /* use backend default access if no backend acls */
 162         if( be != NULL && be->be_acl == NULL ) {
 163 #ifdef NEW_LOGGING
 164                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 165                        "access_allowed: conn %d backend default %s access %s to \"%s\"\n",
 166                        conn->c_connid, access2str( access ),
 167                        be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn ));
 168 #else
 169                 Debug( LDAP_DEBUG_ACL,
 170                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
 171                         access2str( access ),
 172                         be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn );
 173 #endif
 174                 return be->be_dfltaccess >= access;
 175
 176 #ifdef notdef
 177         /* be is always non-NULL */
 178         /* use global default access if no global acls */
 179         } else if ( be == NULL && global_acl == NULL ) {
 180 #ifdef NEW_LOGGING
 181                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 182                        "access_allowed: conn %d global default %s access %s to \"%s\"\n",
 183                        conn->c_connid, access2str( access ),
 184                        global_default_access >= access ? "granted" : "denied", op->o_dn ));
 185 #else
 186                 Debug( LDAP_DEBUG_ACL,
 187                         "=> access_allowed: global default %s access %s to \"%s\"\n",
 188                         access2str( access ),
 189                         global_default_access >= access ? "granted" : "denied", op->o_dn );
 190 #endif
 191                 return global_default_access >= access;
 192 #endif
 193         }
 194
 195         ACL_INIT(mask);
 196         memset(matches, '\0', sizeof(matches));
 197
 198         control = ACL_BREAK;
 199         a = NULL;
 200         count = 0;
 201
 202         while((a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches )) != NULL)
 203         {
 204                 int i;
 205
 206                 for (i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++) {
 207 #ifdef NEW_LOGGING
 208                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 209                                "access_allowed: conn %d match[%d]:  %d %d ",
 210                                conn->c_connid, i, (int)matches[i].rm_so, (int)matches[i].rm_eo ));
 211 #else
 212                         Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
 213                                (int)matches[i].rm_so, (int)matches[i].rm_eo );
 214 #endif
 215                         if( matches[i].rm_so <= matches[0].rm_eo ) {
 216                                 int n;
 217                                 for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++) {
 218                                         Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 219                                 }
 220                         }
 221 #ifdef NEW_LOGGING
 222                         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS, "\n" ));
 223 #else
 224                         Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 225 #endif
 226                 }
 227
 228                 control = acl_mask( a, &mask, be, conn, op,
 229                         e, desc, val, matches );
 230
 231                 if ( control != ACL_BREAK ) {
 232                         break;
 233                 }
 234
 235                 memset(matches, '\0', sizeof(matches));
 236         }
 237
 238         if ( ACL_IS_INVALID( mask ) ) {
 239 #ifdef NEW_LOGGING
 240                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 241                        "access_allowed: conn %d  \"%s\" (%s) invalid!\n",
 242                        conn->c_connid, e->e_dn, attr ));
 243 #else
 244                 Debug( LDAP_DEBUG_ACL,
 245                         "=> access_allowed: \"%s\" (%s) invalid!\n",
 246                         e->e_dn, attr, 0 );
 247 #endif
 248                 ACL_INIT( mask );
 249
 250         } else if ( control == ACL_BREAK ) {
 251 #ifdef NEW_LOGGING
 252                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 253                        "access_allowed: conn %d  no more rules\n", conn->c_connid ));
 254 #else
 255                 Debug( LDAP_DEBUG_ACL,
 256                         "=> access_allowed: no more rules\n", 0, 0, 0);
 257 #endif
 258                 ACL_INIT( mask );
 259         }
 260
 261 #ifdef NEW_LOGGING
 262         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 263                    "access_allowed: conn %d  %s access %s by %s\n",
 264                    conn->c_connid,
 265                    access2str( access ),
 266                    ACL_GRANT( mask, access ) ? "granted" : "denied",
 267                    accessmask2str( mask, accessmaskbuf ) ));
 268 #else
 269         Debug( LDAP_DEBUG_ACL,
 270                 "=> access_allowed: %s access %s by %s\n",
 271                 access2str( access ),
 272                 ACL_GRANT(mask, access) ? "granted" : "denied",
 273                 accessmask2str( mask, accessmaskbuf ) );
 274 #endif
 275         return ACL_GRANT(mask, access);
 276 }
 277
 278 /*
 279  * acl_get - return the acl applicable to entry e, attribute
 280  * attr.  the acl returned is suitable for use in subsequent calls to
 281  * acl_access_allowed().
 282  */
 283
 284 static AccessControl *
 285 acl_get(
 286         AccessControl *a,
 287         int                     *count,
 288     Backend             *be,
 289     Operation   *op,
 290     Entry               *e,
 291         AttributeDescription *desc,
 292     int                 nmatch,
 293     regmatch_t  *matches )
 294 {
 295         const char *attr;
 296         int dnlen, patlen;
 297
 298         assert( e != NULL );
 299         assert( count != NULL );
 300         assert( desc != NULL );
 301
 302         attr = desc->ad_cname.bv_val;
 303
 304         assert( attr != NULL );
 305
 306         if( a == NULL ) {
 307                 if( be == NULL ) {
 308                         a = global_acl;
 309                 } else {
 310                         a = be->be_acl;
 311                 }
 312
 313                 assert( a != NULL );
 314
 315         } else {
 316                 a = a->acl_next;
 317         }
 318
 319         dnlen = e->e_nname.bv_len;
 320
 321         for ( ; a != NULL; a = a->acl_next ) {
 322                 (*count) ++;
 323
 324                 if (a->acl_dn_pat.bv_len != 0) {
 325                         if ( a->acl_dn_style == ACL_STYLE_REGEX ) {
 326 #ifdef NEW_LOGGING
 327                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 328                                            "acl_get: dnpat [%d] %s nsub: %d\n",
 329                                            *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub ));
 330 #else
 331                                 Debug( LDAP_DEBUG_ACL, "=> dnpat: [%d] %s nsub: %d\n",
 332                                         *count, a->acl_dn_pat.bv_val, (int) a->acl_dn_re.re_nsub );
 333 #endif
 334                                 if (regexec(&a->acl_dn_re, e->e_ndn, nmatch, matches, 0))
 335                                         continue;
 336
 337                         } else {
 338 #ifdef NEW_LOGGING
 339                                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 340                                            "acl_get: dn [%d] %s\n",
 341                                            *count, a->acl_dn_pat.bv_val ));
 342 #else
 343                                 Debug( LDAP_DEBUG_ACL, "=> dn: [%d] %s\n",
 344                                         *count, a->acl_dn_pat.bv_val, 0 );
 345 #endif
 346                                 patlen = a->acl_dn_pat.bv_len;
 347                                 if ( dnlen < patlen )
 348                                         continue;
 349
 350                                 if ( a->acl_dn_style == ACL_STYLE_BASE ) {
 351                                         /* base dn -- entire object DN must match */
 352                                         if ( dnlen != patlen )
 353                                                 continue;
 354
 355                                 } else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
 356                                         int rdnlen = -1;
 357
 358                                         if ( dnlen <= patlen )
 359                                                 continue;
 360
 361                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 362                                                 continue;
 363
 364                                         rdnlen = dn_rdnlen( NULL, &e->e_nname );
 365                                         if ( rdnlen != dnlen - patlen - 1 )
 366                                                 continue;
 367
 368                                 } else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
 369                                         if ( dnlen > patlen && ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) ) )
 370                                                 continue;
 371
 372                                 } else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
 373                                         if ( dnlen <= patlen )
 374                                                 continue;
 375                                         if ( !DN_SEPARATOR( e->e_ndn[dnlen - patlen - 1] ) || DN_ESCAPE( e->e_ndn[dnlen - patlen - 2] ) )
 376                                                 continue;
 377                                 }
 378
 379                                 if ( strcmp( a->acl_dn_pat.bv_val, e->e_ndn + dnlen - patlen ) != 0 )
 380                                         continue;
 381                         }
 382
 383 #ifdef NEW_LOGGING
 384                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 385                                    "acl_get: [%d] matched\n",
 386                                    *count ));
 387 #else
 388                         Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] matched\n",
 389                                 *count, 0, 0 );
 390 #endif
 391                 }
 392
 393                 if ( a->acl_filter != NULL ) {
 394                         ber_int_t rc = test_filter( NULL, NULL, NULL, e, a->acl_filter );
 395                         if ( rc != LDAP_COMPARE_TRUE ) {
 396                                 continue;
 397                         }
 398                 }
 399
 400 #ifdef NEW_LOGGING
 401                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 402                            "acl_get: [%d] check attr %s\n",
 403                            *count, attr ));
 404 #else
 405                 Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] check attr %s\n",
 406                        *count, attr, 0);
 407 #endif
 408                 if ( attr == NULL || a->acl_attrs == NULL ||
 409                         ad_inlist( desc, a->acl_attrs ) )
 410                 {
 411 #ifdef NEW_LOGGING
 412                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 413                                    "acl_get:  [%d] acl %s attr: %s\n",
 414                                    *count, e->e_dn, attr ));
 415 #else
 416                         Debug( LDAP_DEBUG_ACL,
 417                                 "<= acl_get: [%d] acl %s attr: %s\n",
 418                                 *count, e->e_dn, attr );
 419 #endif
 420                         return a;
 421                 }
 422                 matches[0].rm_so = matches[0].rm_eo = -1;
 423         }
 424
 425 #ifdef NEW_LOGGING
 426         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 427                    "acl_get: done.\n" ));
 428 #else
 429         Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
 430 #endif
 431         return( NULL );
 432 }
 433
 434
 435 /*
 436  * acl_mask - modifies mask based upon the given acl and the
 437  * requested access to entry e, attribute attr, value val.  if val
 438  * is null, access to the whole attribute is assumed (all values).
 439  *
 440  * returns      0       access NOT allowed
 441  *              1       access allowed
 442  */
 443
 444 static slap_control_t
 445 acl_mask(
 446     AccessControl       *a,
 447         slap_mask_t *mask,
 448     Backend             *be,
 449     Connection  *conn,
 450     Operation   *op,
 451     Entry               *e,
 452         AttributeDescription *desc,
 453     struct berval       *val,
 454         regmatch_t      *matches
 455 )
 456 {
 457         int             i, odnlen, patlen;
 458         Access  *b;
 459 #ifdef LDAP_DEBUG
 460         char accessmaskbuf[ACCESSMASK_MAXLEN];
 461 #endif
 462         const char *attr;
 463
 464         assert( a != NULL );
 465         assert( mask != NULL );
 466         assert( desc != NULL );
 467
 468         attr = desc->ad_cname.bv_val;
 469
 470         assert( attr != NULL );
 471
 472 #ifdef NEW_LOGGING
 473         LDAP_LOG(( "acl", LDAP_LEVEL_ENTRY,
 474                    "acl_mask: conn %d  access to entry \"%s\", attr \"%s\" requested\n",
 475                    conn->c_connid, e->e_dn, attr ));
 476
 477         LDAP_LOG(( "acl", LDAP_LEVEL_ARGS,
 478                    " to %s by \"%s\", (%s) \n",
 479                    val ? "value" : "all values",
 480                    op->o_ndn ? op->o_ndn : "",
 481                    accessmask2str( *mask, accessmaskbuf ) ));
 482 #else
 483         Debug( LDAP_DEBUG_ACL,
 484                 "=> acl_mask: access to entry \"%s\", attr \"%s\" requested\n",
 485                 e->e_dn, attr, 0 );
 486
 487         Debug( LDAP_DEBUG_ACL,
 488                 "=> acl_mask: to %s by \"%s\", (%s) \n",
 489                 val ? "value" : "all values",
 490                 op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
 491                 accessmask2str( *mask, accessmaskbuf ) );
 492 #endif
 493
 494         for ( i = 1, b = a->acl_access; b != NULL; b = b->a_next, i++ ) {
 495                 slap_mask_t oldmask, modmask;
 496
 497                 ACL_INVALIDATE( modmask );
 498
 499                 /* AND <who> clauses */
 500                 if ( b->a_dn_pat.bv_len != 0 ) {
 501 #ifdef NEW_LOGGING
 502                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 503                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 504                                    conn->c_connid, b->a_dn_pat.bv_val ));
 505 #else
 506                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
 507                                 b->a_dn_pat.bv_val, 0, 0);
 508 #endif
 509                         /*
 510                          * if access applies to the entry itself, and the
 511                          * user is bound as somebody in the same namespace as
 512                          * the entry, OR the given dn matches the dn pattern
 513                          */
 514                         if ( b->a_dn_pat.bv_len == sizeof("anonymous") -1 &&
 515                             strcmp( b->a_dn_pat.bv_val, "anonymous" ) == 0 ) {
 516                                 if (op->o_ndn.bv_len != 0 ) {
 517                                         continue;
 518                                 }
 519
 520                         } else if ( b->a_dn_pat.bv_len == sizeof("users") - 1 &&
 521                             strcmp( b->a_dn_pat.bv_val, "users" ) == 0 ) {
 522                                 if (op->o_ndn.bv_len == 0 ) {
 523                                         continue;
 524                                 }
 525
 526                         } else if ( b->a_dn_pat.bv_len == sizeof("self") - 1 &&
 527                             strcmp( b->a_dn_pat.bv_val, "self" ) == 0 ) {
 528                                 if( op->o_ndn.bv_len == 0 ) {
 529                                         continue;
 530                                 }
 531
 532                                 if ( e->e_dn == NULL || strcmp( e->e_ndn, op->o_ndn.bv_val ) != 0 ) {
 533                                         continue;
 534                                 }
 535
 536                         } else if ( b->a_dn_style == ACL_STYLE_REGEX ) {
 537                                 if ( b->a_dn_pat.bv_len != 1 ||
 538                                     strcmp( b->a_dn_pat.bv_val, "*" ) != 0 ) {
 539                                         int ret = regex_matches( b->a_dn_pat.bv_val,
 540                                                 op->o_ndn.bv_val, e->e_ndn, matches );
 541
 542                                         if( ret == 0 ) {
 543                                                 continue;
 544                                         }
 545                                 }
 546
 547                         } else {
 548                                 if ( e->e_dn == NULL )
 549                                         continue;
 550
 551                                 patlen = b->a_dn_pat.bv_len;
 552                                 odnlen = op->o_ndn.bv_len;
 553                                 if ( odnlen < patlen )
 554                                         continue;
 555
 556                                 if ( b->a_dn_style == ACL_STYLE_BASE ) {
 557                                         /* base dn -- entire object DN must match */
 558                                         if ( odnlen != patlen )
 559                                                 continue;
 560
 561                                 } else if ( b->a_dn_style == ACL_STYLE_ONE ) {
 562                                         int rdnlen = -1;
 563
 564                                         if ( odnlen <= patlen )
 565                                                 continue;
 566
 567                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 568                                                 continue;
 569
 570                                         rdnlen = dn_rdnlen( NULL, &op->o_ndn );
 571                                         if ( rdnlen != odnlen - patlen - 1 )
 572                                                 continue;
 573
 574                                 } else if ( b->a_dn_style == ACL_STYLE_SUBTREE ) {
 575                                         if ( odnlen > patlen && ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) ) )
 576                                                 continue;
 577
 578                                 } else if ( b->a_dn_style == ACL_STYLE_CHILDREN ) {
 579                                         if ( odnlen <= patlen )
 580                                                 continue;
 581                                         if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) || DN_ESCAPE( op->o_ndn.bv_val[odnlen - patlen - 2] ) )
 582                                                 continue;
 583                                 }
 584
 585                                 if ( strcmp( b->a_dn_pat.bv_val, op->o_ndn.bv_val + odnlen - patlen ) != 0 )
 586                                         continue;
 587
 588                         }
 589                 }
 590
 591                 if ( b->a_sockurl_pat != NULL ) {
 592 #ifdef NEW_LOGGING
 593                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 594                                    "acl_mask: conn %d  check a_sockurl_pat: %s\n",
 595                                    conn->c_connid, b->a_sockurl_pat ));
 596 #else
 597                         Debug( LDAP_DEBUG_ACL, "<= check a_sockurl_pat: %s\n",
 598                                 b->a_sockurl_pat, 0, 0 );
 599 #endif
 600
 601                         if ( strcmp( b->a_sockurl_pat, "*" ) != 0) {
 602                                 if ( b->a_sockurl_style == ACL_STYLE_REGEX) {
 603                                         if (!regex_matches( b->a_sockurl_pat, conn->c_listener_url,
 604                                                         e->e_ndn, matches ) )
 605                                         {
 606                                                 continue;
 607                                         }
 608                                 } else {
 609                                         if ( strcasecmp( b->a_sockurl_pat, conn->c_listener_url ) == 0 )
 610                                                 continue;
 611                                 }
 612                         }
 613                 }
 614
 615                 if ( b->a_domain_pat != NULL ) {
 616 #ifdef NEW_LOGGING
 617                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 618                                    "acl_mask: conn %d  check a_domain_pat: %s\n",
 619                                    conn->c_connid, b->a_domain_pat ));
 620 #else
 621                         Debug( LDAP_DEBUG_ACL, "<= check a_domain_pat: %s\n",
 622                                 b->a_domain_pat, 0, 0 );
 623 #endif
 624                         if ( strcmp( b->a_domain_pat, "*" ) != 0) {
 625                                 if ( b->a_domain_style == ACL_STYLE_REGEX) {
 626                                         if (!regex_matches( b->a_domain_pat, conn->c_peer_domain,
 627                                                         e->e_ndn, matches ) )
 628                                         {
 629                                                 continue;
 630                                         }
 631                                 } else {
 632                                         if ( strcasecmp( b->a_domain_pat, conn->c_peer_domain ) == 0 )
 633                                                 continue;
 634                                 }
 635                         }
 636                 }
 637
 638                 if ( b->a_peername_pat != NULL ) {
 639 #ifdef NEW_LOGGING
 640                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 641                                    "acl_mask: conn %d  check a_perrname_path: %s\n",
 642                                    conn->c_connid, b->a_peername_pat ));
 643 #else
 644                         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
 645                                 b->a_peername_pat, 0, 0 );
 646 #endif
 647                         if ( strcmp( b->a_peername_pat, "*" ) != 0) {
 648                                 if ( b->a_peername_style == ACL_STYLE_REGEX) {
 649                                         if (!regex_matches( b->a_peername_pat, conn->c_peer_name,
 650                                                         e->e_ndn, matches ) )
 651                                         {
 652                                                 continue;
 653                                         }
 654                                 } else {
 655                                         if ( strcasecmp( b->a_peername_pat, conn->c_peer_name ) == 0 )
 656                                                 continue;
 657                                 }
 658                         }
 659                 }
 660
 661                 if ( b->a_sockname_pat != NULL ) {
 662 #ifdef NEW_LOGGING
 663                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 664                                    "acl_mask: conn %d  check a_sockname_path: %s\n",
 665                                    conn->c_connid, b->a_sockname_pat ));
 666 #else
 667                         Debug( LDAP_DEBUG_ACL, "<= check a_sockname_path: %s\n",
 668                                 b->a_sockname_pat, 0, 0 );
 669 #endif
 670                         if ( strcmp( b->a_sockname_pat, "*" ) != 0) {
 671                                 if ( b->a_sockname_style == ACL_STYLE_REGEX) {
 672                                         if (!regex_matches( b->a_sockname_pat, conn->c_sock_name,
 673                                                         e->e_ndn, matches ) )
 674                                         {
 675                                                 continue;
 676                                         }
 677                                 } else {
 678                                         if ( strcasecmp( b->a_sockname_pat, conn->c_sock_name ) == 0 )
 679                                                 continue;
 680                                 }
 681                         }
 682                 }
 683
 684                 if ( b->a_dn_at != NULL && op->o_ndn.bv_len != 0 ) {
 685                         Attribute       *at;
 686                         struct berval   bv;
 687                         int rc, match = 0;
 688                         const char *text;
 689                         const char *attr = b->a_dn_at->ad_cname.bv_val;
 690
 691                         assert( attr != NULL );
 692
 693 #ifdef NEW_LOGGING
 694                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 695                                    "acl_mask: conn %d  check a_dn_pat: %s\n",
 696                                    conn->c_connid, attr ));
 697 #else
 698                         Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n",
 699                                 attr, 0, 0);
 700 #endif
 701                         bv = op->o_ndn;
 702
 703                         /* see if asker is listed in dnattr */
 704                         for( at = attrs_find( e->e_attrs, b->a_dn_at );
 705                                 at != NULL;
 706                                 at = attrs_find( at->a_next, b->a_dn_at ) )
 707                         {
 708                                 if( value_find( b->a_dn_at, at->a_vals, &bv ) == 0 ) {
 709                                         /* found it */
 710                                         match = 1;
 711                                         break;
 712                                 }
 713                         }
 714
 715                         if( match ) {
 716                                 /* have a dnattr match. if this is a self clause then
 717                                  * the target must also match the op dn.
 718                                  */
 719                                 if ( b->a_dn_self ) {
 720                                         /* check if the target is an attribute. */
 721                                         if ( val == NULL )
 722                                                 continue;
 723                                         /* target is attribute, check if the attribute value
 724                                          * is the op dn.
 725                                          */
 726                                         rc = value_match( &match, b->a_dn_at,
 727                                                 b->a_dn_at->ad_type->sat_equality, 0,
 728                                                 val, &bv, &text );
 729                                         /* on match error or no match, fail the ACL clause */
 730                                         if (rc != LDAP_SUCCESS || match != 0 )
 731                                                 continue;
 732                                 }
 733                         } else {
 734                                 /* no dnattr match, check if this is a self clause */
 735                                 if ( ! b->a_dn_self )
 736                                         continue;
 737                                 /* this is a self clause, check if the target is an
 738                                  * attribute.
 739                                  */
 740                                 if ( val == NULL )
 741                                         continue;
 742                                 /* target is attribute, check if the attribute value
 743                                  * is the op dn.
 744                                  */
 745                                 rc = value_match( &match, b->a_dn_at,
 746                                         b->a_dn_at->ad_type->sat_equality, 0,
 747                                         val, &bv, &text );
 748
 749                                 /* on match error or no match, fail the ACL clause */
 750                                 if (rc != LDAP_SUCCESS || match != 0 )
 751                                         continue;
 752                         }
 753                 }
 754
 755                 if ( b->a_group_pat.bv_len && op->o_ndn.bv_len ) {
 756                         char buf[1024];
 757                         struct berval bv = {1024, buf };
 758                         struct berval *ndn = NULL;
 759                         int rc;
 760
 761                         /* b->a_group is an unexpanded entry name, expanded it should be an
 762                          * entry with objectclass group* and we test to see if odn is one of
 763                          * the values in the attribute group
 764                          */
 765                         /* see if asker is listed in dnattr */
 766                         if ( b->a_group_style == ACL_STYLE_REGEX ) {
 767                                 string_expand(&bv, b->a_group_pat.bv_val, e->e_ndn, matches);
 768                                 if ( dnNormalize(NULL, &bv, &ndn) != LDAP_SUCCESS ) {
 769                                         /* did not expand to a valid dn */
 770                                         continue;
 771                                 }
 772                                 bv = *ndn;
 773                         } else {
 774                                 bv = b->a_group_pat;
 775                         }
 776
 777                         rc = backend_group(be, conn, op, e, &bv, &op->o_ndn,
 778                                 b->a_group_oc, b->a_group_at);
 779                         if ( ndn )
 780                                 ber_bvfree( ndn );
 781                         if ( rc != 0 )
 782                         {
 783                                 continue;
 784                         }
 785                 }
 786
 787                 if ( b->a_set_pat.bv_len != 0 ) {
 788                         if (aci_match_set( &b->a_set_pat, be, e, conn, op, 0 ) == 0) {
 789                                 continue;
 790                         }
 791                 }
 792
 793                 if ( b->a_authz.sai_ssf ) {
 794 #ifdef NEW_LOGGING
 795                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 796                                    "acl_mask: conn %d  check a_authz.sai_ssf: ACL %u > OP %u\n",
 797                                    conn->c_connid, b->a_authz.sai_ssf, op->o_ssf ));
 798 #else
 799                         Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
 800                                 b->a_authz.sai_ssf, op->o_ssf, 0 );
 801 #endif
 802                         if ( b->a_authz.sai_ssf >  op->o_ssf ) {
 803                                 continue;
 804                         }
 805                 }
 806
 807                 if ( b->a_authz.sai_transport_ssf ) {
 808 #ifdef NEW_LOGGING
 809                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 810                                    "acl_mask: conn %d  check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 811                                    conn->c_connid, b->a_authz.sai_transport_ssf, op->o_transport_ssf ));
 812 #else
 813                         Debug( LDAP_DEBUG_ACL,
 814                                 "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
 815                                 b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
 816 #endif
 817                         if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
 818                                 continue;
 819                         }
 820                 }
 821
 822                 if ( b->a_authz.sai_tls_ssf ) {
 823 #ifdef NEW_LOGGING
 824                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 825                                    "acl_mask: conn %d  check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 826                                    conn->c_connid, b->a_authz.sai_tls_ssf, op->o_tls_ssf ));
 827 #else
 828                         Debug( LDAP_DEBUG_ACL,
 829                                 "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
 830                                 b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
 831 #endif
 832                         if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
 833                                 continue;
 834                         }
 835                 }
 836
 837                 if ( b->a_authz.sai_sasl_ssf ) {
 838 #ifdef NEW_LOGGING
 839                         LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
 840                                    "acl_mask: conn %d check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 841                                    conn->c_connid, b->a_authz.sai_sasl_ssf, op->o_sasl_ssf ));
 842 #else
 843                         Debug( LDAP_DEBUG_ACL,
 844                                 "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
 845                                 b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
 846 #endif
 847                         if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
 848                                 continue;
 849                         }
 850                 }
 851
 852 #ifdef SLAPD_ACI_ENABLED
 853                 if ( b->a_aci_at != NULL ) {
 854                         Attribute       *at;
 855                         slap_access_t grant, deny, tgrant, tdeny;
 856
 857                         /* this case works different from the others above.
 858                          * since aci's themselves give permissions, we need
 859                          * to first check b->a_access_mask, the ACL's access level.
 860                          */
 861
 862                         if( op->o_ndn.bv_len == 0 ) {
 863                                 continue;
 864                         }
 865
 866                         if ( e->e_dn == NULL ) {
 867                                 continue;
 868                         }
 869
 870                         /* first check if the right being requested
 871                          * is allowed by the ACL clause.
 872                          */
 873                         if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
 874                                 continue;
 875                         }
 876
 877                         /* get the aci attribute */
 878                         at = attr_find( e->e_attrs, b->a_aci_at );
 879                         if ( at == NULL ) {
 880                                 continue;
 881                         }
 882
 883                         /* start out with nothing granted, nothing denied */
 884                         ACL_INIT(tgrant);
 885                         ACL_INIT(tdeny);
 886
 887                         /* the aci is an multi-valued attribute.  The
 888                          * rights are determined by OR'ing the individual
 889                          * rights given by the acis.
 890                          */
 891                         for ( i = 0; at->a_vals[i] != NULL; i++ ) {
 892                                 if (aci_mask( be, conn, op,
 893                                         e, desc, val, at->a_vals[i],
 894                                         matches, &grant, &deny ) != 0)
 895                                 {
 896                                         tgrant |= grant;
 897                                         tdeny |= deny;
 898                                 }
 899                         }
 900
 901                         /* remove anything that the ACL clause does not allow */
 902                         tgrant &= b->a_access_mask & ACL_PRIV_MASK;
 903                         tdeny &= ACL_PRIV_MASK;
 904
 905                         /* see if we have anything to contribute */
 906                         if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
 907                                 continue;
 908                         }
 909
 910                         /* this could be improved by changing acl_mask so that it can deal with
 911                          * by clauses that return grant/deny pairs.  Right now, it does either
 912                          * additive or subtractive rights, but not both at the same time.  So,
 913                          * we need to combine the grant/deny pair into a single rights mask in
 914                          * a smart way:  if either grant or deny is "empty", then we use the
 915                          * opposite as is, otherwise we remove any denied rights from the grant
 916                          * rights mask and construct an additive mask.
 917                          */
 918                         if (ACL_IS_INVALID(tdeny)) {
 919                                 modmask = tgrant | ACL_PRIV_ADDITIVE;
 920
 921                         } else if (ACL_IS_INVALID(tgrant)) {
 922                                 modmask = tdeny | ACL_PRIV_SUBSTRACTIVE;
 923
 924                         } else {
 925                                 modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE;
 926                         }
 927
 928                 } else
 929 #endif
 930                 {
 931                         modmask = b->a_access_mask;
 932                 }
 933
 934 #ifdef NEW_LOGGING
 935                 LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 936                            "acl_mask: conn %d  [%d] applying %s (%s)\n",
 937                            conn->c_connid, i, accessmask2str( modmask, accessmaskbuf),
 938                            b->a_type == ACL_CONTINUE ? "continue" : b->a_type == ACL_BREAK
 939                            ? "break" : "stop" ));
 940 #else
 941                 Debug( LDAP_DEBUG_ACL,
 942                         "<= acl_mask: [%d] applying %s (%s)\n",
 943                         i, accessmask2str( modmask, accessmaskbuf ),
 944                         b->a_type == ACL_CONTINUE
 945                                 ? "continue"
 946                                 : b->a_type == ACL_BREAK
 947                                         ? "break"
 948                                         : "stop" );
 949 #endif
 950                 /* save old mask */
 951                 oldmask = *mask;
 952
 953                 if( ACL_IS_ADDITIVE(modmask) ) {
 954                         /* add privs */
 955                         ACL_PRIV_SET( *mask, modmask );
 956
 957                         /* cleanup */
 958                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 959
 960                 } else if( ACL_IS_SUBTRACTIVE(modmask) ) {
 961                         /* substract privs */
 962                         ACL_PRIV_CLR( *mask, modmask );
 963
 964                         /* cleanup */
 965                         ACL_PRIV_CLR( *mask, ~ACL_PRIV_MASK );
 966
 967                 } else {
 968                         /* assign privs */
 969                         *mask = modmask;
 970                 }
 971
 972 #ifdef NEW_LOGGING
 973                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
 974                            "acl_mask: conn %d  [%d] mask: %s\n",
 975                            conn->c_connid, i, accessmask2str( *mask, accessmaskbuf) ));
 976 #else
 977                 Debug( LDAP_DEBUG_ACL,
 978                         "<= acl_mask: [%d] mask: %s\n",
 979                         i, accessmask2str(*mask, accessmaskbuf), 0 );
 980 #endif
 981
 982                 if( b->a_type == ACL_CONTINUE ) {
 983                         continue;
 984
 985                 } else if ( b->a_type == ACL_BREAK ) {
 986                         return ACL_BREAK;
 987
 988                 } else {
 989                         return ACL_STOP;
 990                 }
 991         }
 992
 993         /* implicit "by * none" clause */
 994         ACL_INIT(*mask);
 995
 996 #ifdef NEW_LOGGING
 997         LDAP_LOG(( "acl", LDAP_LEVEL_RESULTS,
 998                    "acl_mask: conn %d  no more <who> clauses, returning %d (stop)\n",
 999                    conn->c_connid, accessmask2str( *mask, accessmaskbuf) ));
1000 #else
1001         Debug( LDAP_DEBUG_ACL,
1002                 "<= acl_mask: no more <who> clauses, returning %s (stop)\n",
1003                 accessmask2str(*mask, accessmaskbuf), 0, 0 );
1004 #endif
1005         return ACL_STOP;
1006 }
1007
1008 /*
1009  * acl_check_modlist - check access control on the given entry to see if
1010  * it allows the given modifications by the user associated with op.
1011  * returns      1       if mods allowed ok
1012  *                      0       mods not allowed
1013  */
1014
1015 int
1016 acl_check_modlist(
1017     Backend     *be,
1018     Connection  *conn,
1019     Operation   *op,
1020     Entry       *e,
1021     Modifications       *mlist
1022 )
1023 {
1024         int             i;
1025
1026         assert( be != NULL );
1027
1028         /* short circuit root database access */
1029         if ( be_isroot( be, &op->o_ndn ) ) {
1030 #ifdef NEW_LOGGING
1031                 LDAP_LOG(( "acl", LDAP_LEVEL_DETAIL1,
1032                            "acl_check_modlist: conn %d  access granted to root user\n",
1033                            conn->c_connid ));
1034 #else
1035                 Debug( LDAP_DEBUG_ACL,
1036                         "<= acl_access_allowed: granted to database root\n",
1037                     0, 0, 0 );
1038 #endif
1039                 return 1;
1040         }
1041
1042         /* use backend default access if no backend acls */
1043         if( be != NULL && be->be_acl == NULL ) {
1044 #ifdef NEW_LOGGING
1045                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1046                            "acl_check_modlist: conn %d  backend default %s access %s to \"%s\"\n",
1047                            conn->c_connid, access2str( ACL_WRITE ),
1048                            be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn ));
1049 #else
1050                 Debug( LDAP_DEBUG_ACL,
1051                         "=> access_allowed: backend default %s access %s to \"%s\"\n",
1052                         access2str( ACL_WRITE ),
1053                         be->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn );
1054 #endif
1055                 return be->be_dfltaccess >= ACL_WRITE;
1056
1057 #ifdef notdef
1058         /* be is always non-NULL */
1059         /* use global default access if no global acls */
1060         } else if ( be == NULL && global_acl == NULL ) {
1061 #ifdef NEW_LOGGING
1062                 LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1063                            "acl_check_modlist: conn %d  global default %s access %s to \"%s\"\n",
1064                            conn->c_connid, access2str( ACL_WRITE ),
1065                            global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn ));
1066 #else
1067                 Debug( LDAP_DEBUG_ACL,
1068                         "=> access_allowed: global default %s access %s to \"%s\"\n",
1069                         access2str( ACL_WRITE ),
1070                         global_default_access >= ACL_WRITE ? "granted" : "denied", op->o_dn );
1071 #endif
1072                 return global_default_access >= ACL_WRITE;
1073 #endif
1074         }
1075
1076         for ( ; mlist != NULL; mlist = mlist->sml_next ) {
1077                 /*
1078                  * no-user-modification operational attributes are ignored
1079                  * by ACL_WRITE checking as any found here are not provided
1080                  * by the user
1081                  */
1082                 if ( is_at_no_user_mod( mlist->sml_desc->ad_type ) ) {
1083 #ifdef NEW_LOGGING
1084                         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1085                                    "acl_check_modlist: conn %d  no-user-mod %s: modify access granted\n",
1086                                    conn->c_connid, mlist->sml_desc->ad_cname.bv_val ));
1087 #else
1088                         Debug( LDAP_DEBUG_ACL, "acl: no-user-mod %s:"
1089                                 " modify access granted\n",
1090                                 mlist->sml_desc->ad_cname.bv_val, 0, 0 );
1091 #endif
1092                         continue;
1093                 }
1094
1095                 switch ( mlist->sml_op ) {
1096                 case LDAP_MOD_REPLACE:
1097                 case LDAP_MOD_ADD:
1098                         if ( mlist->sml_bvalues == NULL ) {
1099                                 break;
1100                         }
1101                         for ( i = 0; mlist->sml_bvalues[i] != NULL; i++ ) {
1102                                 if ( ! access_allowed( be, conn, op, e,
1103                                         mlist->sml_desc, mlist->sml_bvalues[i], ACL_WRITE ) )
1104                                 {
1105                                         return( 0 );
1106                                 }
1107                         }
1108                         break;
1109
1110                 case LDAP_MOD_DELETE:
1111                         if ( mlist->sml_bvalues == NULL ) {
1112                                 if ( ! access_allowed( be, conn, op, e,
1113                                         mlist->sml_desc, NULL, ACL_WRITE ) )
1114                                 {
1115                                         return( 0 );
1116                                 }
1117                                 break;
1118                         }
1119                         for ( i = 0; mlist->sml_bvalues[i] != NULL; i++ ) {
1120                                 if ( ! access_allowed( be, conn, op, e,
1121                                         mlist->sml_desc, mlist->sml_bvalues[i], ACL_WRITE ) )
1122                                 {
1123                                         return( 0 );
1124                                 }
1125                         }
1126                         break;
1127                 }
1128         }
1129
1130         return( 1 );
1131 }
1132
1133 static char *
1134 aci_bvstrdup( struct berval *bv )
1135 {
1136         char *s;
1137
1138         s = (char *)ch_malloc(bv->bv_len + 1);
1139         if (s != NULL) {
1140                 AC_MEMCPY(s, bv->bv_val, bv->bv_len);
1141                 s[bv->bv_len] = 0;
1142         }
1143         return(s);
1144 }
1145
1146 #ifdef SLAPD_ACI_ENABLED
1147 static int
1148 aci_strbvcmp(
1149         const char *s,
1150         struct berval *bv )
1151 {
1152         int res, len;
1153
1154         res = strncasecmp( s, bv->bv_val, bv->bv_len );
1155         if (res)
1156                 return(res);
1157         len = strlen(s);
1158         if (len > (int)bv->bv_len)
1159                 return(1);
1160         if (len < (int)bv->bv_len)
1161                 return(-1);
1162         return(0);
1163 }
1164 #endif
1165
1166 static int
1167 aci_get_part(
1168         struct berval *list,
1169         int ix,
1170         char sep,
1171         struct berval *bv )
1172 {
1173         int len;
1174         char *p;
1175
1176         if (bv) {
1177                 bv->bv_len = 0;
1178                 bv->bv_val = NULL;
1179         }
1180         len = list->bv_len;
1181         p = list->bv_val;
1182         while (len >= 0 && --ix >= 0) {
1183                 while (--len >= 0 && *p++ != sep) ;
1184         }
1185         while (len >= 0 && *p == ' ') {
1186                 len--;
1187                 p++;
1188         }
1189         if (len < 0)
1190                 return(-1);
1191
1192         if (!bv)
1193                 return(0);
1194
1195         bv->bv_val = p;
1196         while (--len >= 0 && *p != sep) {
1197                 bv->bv_len++;
1198                 p++;
1199         }
1200         while (bv->bv_len > 0 && *--p == ' ')
1201                 bv->bv_len--;
1202         return(bv->bv_len);
1203 }
1204
1205 char **
1206 aci_set_gather (void *cookie, char *name, struct berval *attr)
1207 {
1208         AciSetCookie *cp = cookie;
1209         struct berval **bvals = NULL;
1210         char **vals = NULL;
1211         struct berval bv, *ndn = NULL;
1212         int i;
1213
1214         /* this routine needs to return the bervals instead of
1215          * plain strings, since syntax is not known.  It should
1216          * also return the syntax or some "comparison cookie".
1217          */
1218
1219         bv.bv_val = name;
1220         bv.bv_len = strlen( name );
1221         if (dnNormalize(NULL, &bv, &ndn) == LDAP_SUCCESS) {
1222                 const char *text;
1223                 AttributeDescription *desc = NULL;
1224                 if (slap_bv2ad(attr, &desc, &text) == LDAP_SUCCESS) {
1225                         backend_attribute(cp->be, NULL, NULL,
1226                                 cp->e, ndn, desc, &bvals);
1227                         if (bvals != NULL) {
1228                                 for (i = 0; bvals[i] != NULL; i++) { }
1229                                 vals = ch_calloc(i + 1, sizeof(char *));
1230                                 if (vals != NULL) {
1231                                         while (--i >= 0) {
1232                                                 vals[i] = bvals[i]->bv_val;
1233                                                 bvals[i]->bv_val = NULL;
1234                                         }
1235                                 }
1236                                 ber_bvecfree(bvals);
1237                         }
1238                 }
1239                 ber_bvfree(ndn);
1240         }
1241         return(vals);
1242 }
1243
1244 static int
1245 aci_match_set (
1246         struct berval *subj,
1247     Backend *be,
1248     Entry *e,
1249     Connection *conn,
1250     Operation *op,
1251     int setref
1252 )
1253 {
1254         char *set = NULL;
1255         int rc = 0;
1256         AciSetCookie cookie;
1257
1258         if (setref == 0) {
1259                 set = aci_bvstrdup(subj);
1260         } else {
1261                 struct berval subjdn, *ndn = NULL;
1262                 struct berval setat;
1263                 struct berval **bvals;
1264                 const char *text;
1265                 AttributeDescription *desc = NULL;
1266
1267                 /* format of string is "entry/setAttrName" */
1268                 if (aci_get_part(subj, 0, '/', &subjdn) < 0) {
1269                         return(0);
1270                 } else {
1271                         /* FIXME: If dnNormalize was based on ldap_bv2dn
1272                          * instead of ldap_str2dn and would honor the bv_len
1273                          * we could skip this step and not worry about the
1274                          * unterminated string.
1275                          */
1276                         char *s = ch_malloc(subjdn.bv_len + 1);
1277                         AC_MEMCPY(s, subjdn.bv_val, subjdn.bv_len);
1278                         subjdn.bv_val = s;
1279                 }
1280
1281                 if ( aci_get_part(subj, 1, '/', &setat) < 0 ) {
1282                         setat.bv_val = SLAPD_ACI_SET_ATTR;
1283                         setat.bv_len = sizeof(SLAPD_ACI_SET_ATTR)-1;
1284                 }
1285                 if ( setat.bv_val != NULL ) {
1286                         if ( dnNormalize(NULL, &subjdn, &ndn) == LDAP_SUCCESS
1287                                 && slap_bv2ad(&setat, &desc, &text) == LDAP_SUCCESS )
1288                         {
1289                                 backend_attribute(be, NULL, NULL, e,
1290                                         ndn, desc, &bvals);
1291                                 if ( bvals != NULL ) {
1292                                         if ( bvals[0] != NULL )
1293                                                 set = ch_strdup(bvals[0]->bv_val);
1294                                         ber_bvecfree(bvals);
1295                                 }
1296                         }
1297                         if (ndn)
1298                                 ber_bvfree(ndn);
1299                 }
1300                 ch_free(subjdn.bv_val);
1301         }
1302
1303         if (set != NULL) {
1304                 cookie.be = be;
1305                 cookie.e = e;
1306                 cookie.conn = conn;
1307                 cookie.op = op;
1308                 rc = (set_filter(aci_set_gather, &cookie, set, op->o_ndn.bv_val, e->e_ndn, NULL) > 0);
1309                 ch_free(set);
1310         }
1311         return(rc);
1312 }
1313
1314 #ifdef SLAPD_ACI_ENABLED
1315 static int
1316 aci_list_map_rights(
1317         struct berval *list )
1318 {
1319         struct berval bv;
1320         slap_access_t mask;
1321         int i;
1322
1323         ACL_INIT(mask);
1324         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1325                 if (bv.bv_len <= 0)
1326                         continue;
1327                 switch (*bv.bv_val) {
1328                 case 'c':
1329                         ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
1330                         break;
1331                 case 's':
1332                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt defines
1333                          * the right 's' to mean "set", but in the examples states
1334                          * that the right 's' means "search".  The latter definition
1335                          * is used here.
1336                          */
1337                         ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
1338                         break;
1339                 case 'r':
1340                         ACL_PRIV_SET(mask, ACL_PRIV_READ);
1341                         break;
1342                 case 'w':
1343                         ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
1344                         break;
1345                 case 'x':
1346                         /* **** NOTE: draft-ietf-ldapext-aci-model-0.3.txt does not
1347                          * define any equivalent to the AUTH right, so I've just used
1348                          * 'x' for now.
1349                          */
1350                         ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
1351                         break;
1352                 default:
1353                         break;
1354                 }
1355
1356         }
1357         return(mask);
1358 }
1359
1360 static int
1361 aci_list_has_attr(
1362         struct berval *list,
1363         const char *attr,
1364         struct berval *val )
1365 {
1366         struct berval bv, left, right;
1367         int i;
1368
1369         for (i = 0; aci_get_part(list, i, ',', &bv) >= 0; i++) {
1370                 if (aci_get_part(&bv, 0, '=', &left) < 0
1371                         || aci_get_part(&bv, 1, '=', &right) < 0)
1372                 {
1373                         if (aci_strbvcmp(attr, &bv) == 0)
1374                                 return(1);
1375                 } else if (val == NULL) {
1376                         if (aci_strbvcmp(attr, &left) == 0)
1377                                 return(1);
1378                 } else {
1379                         if (aci_strbvcmp(attr, &left) == 0) {
1380                                 /* this is experimental code that implements a
1381                                  * simple (prefix) match of the attribute value.
1382                                  * the ACI draft does not provide for aci's that
1383                                  * apply to specific values, but it would be
1384                                  * nice to have.  If the <attr> part of an aci's
1385                                  * rights list is of the form <attr>=<value>,
1386                                  * that means the aci applies only to attrs with
1387                                  * the given value.  Furthermore, if the attr is
1388                                  * of the form <attr>=<value>*, then <value> is
1389                                  * treated as a prefix, and the aci applies to
1390                                  * any value with that prefix.
1391                                  *
1392                                  * Ideally, this would allow r.e. matches.
1393                                  */
1394                                 if (aci_get_part(&right, 0, '*', &left) < 0
1395                                         || right.bv_len <= left.bv_len)
1396                                 {
1397                                         if (aci_strbvcmp(val->bv_val, &right) == 0)
1398                                                 return(1);
1399                                 } else if (val->bv_len >= left.bv_len) {
1400                                         if (strncasecmp( val->bv_val, left.bv_val, left.bv_len ) == 0)
1401                                                 return(1);
1402                                 }
1403                         }
1404                 }
1405         }
1406         return(0);
1407 }
1408
1409 static slap_access_t
1410 aci_list_get_attr_rights(
1411         struct berval *list,
1412         const char *attr,
1413         struct berval *val )
1414 {
1415     struct berval bv;
1416     slap_access_t mask;
1417     int i;
1418
1419         /* loop through each rights/attr pair, skip first part (action) */
1420         ACL_INIT(mask);
1421         for (i = 1; aci_get_part(list, i + 1, ';', &bv) >= 0; i += 2) {
1422                 if (aci_list_has_attr(&bv, attr, val) == 0)
1423                         continue;
1424                 if (aci_get_part(list, i, ';', &bv) < 0)
1425                         continue;
1426                 mask |= aci_list_map_rights(&bv);
1427         }
1428         return(mask);
1429 }
1430
1431 static int
1432 aci_list_get_rights(
1433         struct berval *list,
1434         const char *attr,
1435         struct berval *val,
1436         slap_access_t *grant,
1437         slap_access_t *deny )
1438 {
1439     struct berval perm, actn;
1440     slap_access_t *mask;
1441     int i, found;
1442
1443         if (attr == NULL || *attr == 0 || strcasecmp(attr, "entry") == 0) {
1444                 attr = "[entry]";
1445         }
1446
1447         found = 0;
1448         ACL_INIT(*grant);
1449         ACL_INIT(*deny);
1450         /* loop through each permissions clause */
1451         for (i = 0; aci_get_part(list, i, '$', &perm) >= 0; i++) {
1452                 if (aci_get_part(&perm, 0, ';', &actn) < 0)
1453                         continue;
1454                 if (aci_strbvcmp( "grant", &actn ) == 0) {
1455                         mask = grant;
1456                 } else if (aci_strbvcmp( "deny", &actn ) == 0) {
1457                         mask = deny;
1458                 } else {
1459                         continue;
1460                 }
1461
1462                 found = 1;
1463                 *mask |= aci_list_get_attr_rights(&perm, attr, val);
1464                 *mask |= aci_list_get_attr_rights(&perm, "[all]", NULL);
1465         }
1466         return(found);
1467 }
1468
1469 static int
1470 aci_group_member (
1471         struct berval *subj,
1472         struct berval *defgrpoc,
1473         struct berval *defgrpat,
1474     Backend             *be,
1475     Entry               *e,
1476     Connection          *conn,
1477     Operation           *op,
1478         regmatch_t      *matches
1479 )
1480 {
1481         struct berval bv;
1482         char *subjdn;
1483         struct berval grpoc;
1484         struct berval grpat;
1485         ObjectClass *grp_oc = NULL;
1486         AttributeDescription *grp_ad = NULL;
1487         const char *text;
1488         int rc;
1489
1490         /* format of string is "group/objectClassValue/groupAttrName" */
1491         if (aci_get_part(subj, 0, '/', &bv) < 0) {
1492                 return(0);
1493         }
1494
1495         subjdn = aci_bvstrdup(&bv);
1496         if (subjdn == NULL) {
1497                 return(0);
1498         }
1499
1500         if (aci_get_part(subj, 1, '/', &grpoc) < 0) {
1501                 grpoc = *defgrpoc;
1502         }
1503
1504         if (aci_get_part(subj, 2, '/', &grpat) < 0) {
1505                 grpat = *defgrpat;
1506         }
1507
1508         rc = slap_bv2ad( &grpat, &grp_ad, &text );
1509         if( rc != LDAP_SUCCESS ) {
1510                 rc = 0;
1511                 goto done;
1512         }
1513         rc = 0;
1514
1515         grp_oc = oc_bvfind( &grpoc );
1516
1517         if (grp_oc != NULL && grp_ad != NULL ) {
1518                 struct berval *ndn = NULL;
1519                 bv.bv_val = (char *)ch_malloc(1024);
1520                 bv.bv_len = 1024;
1521                 string_expand(&bv, subjdn, e->e_ndn, matches);
1522                 if ( dnNormalize(NULL, &bv, &ndn) == LDAP_SUCCESS ) {
1523                         rc = (backend_group(be, conn, op, e, &bv, &op->o_ndn, grp_oc, grp_ad) == 0);
1524                         ber_bvfree( ndn );
1525                 }
1526                 ch_free(bv.bv_val);
1527         }
1528
1529 done:
1530         ch_free(subjdn);
1531         return(rc);
1532 }
1533
1534 static struct berval GroupClass = {
1535         sizeof(SLAPD_GROUP_CLASS)-1, SLAPD_GROUP_CLASS };
1536 static struct berval GroupAttr = {
1537         sizeof(SLAPD_GROUP_ATTR)-1, SLAPD_GROUP_ATTR };
1538 static struct berval RoleClass = {
1539         sizeof(SLAPD_ROLE_CLASS)-1, SLAPD_ROLE_CLASS };
1540 static struct berval RoleAttr = {
1541         sizeof(SLAPD_ROLE_ATTR)-1, SLAPD_ROLE_ATTR };
1542
1543 static int
1544 aci_mask(
1545     Backend                     *be,
1546     Connection          *conn,
1547     Operation           *op,
1548     Entry                       *e,
1549         AttributeDescription *desc,
1550     struct berval       *val,
1551     struct berval       *aci,
1552         regmatch_t              *matches,
1553         slap_access_t   *grant,
1554         slap_access_t   *deny
1555 )
1556 {
1557     struct berval bv, perms, sdn;
1558         int rc;
1559         char *attr = desc->ad_cname.bv_val;
1560
1561         assert( attr != NULL );
1562
1563         /* parse an aci of the form:
1564                 oid#scope#action;rights;attr;rights;attr$action;rights;attr;rights;attr#dnType#subjectDN
1565
1566            See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
1567            a full description of the format for this attribute.
1568
1569            For now, this routine only supports scope=entry.
1570          */
1571
1572         /* check that the aci has all 5 components */
1573         if (aci_get_part(aci, 4, '#', NULL) < 0)
1574                 return(0);
1575
1576         /* check that the aci family is supported */
1577         if (aci_get_part(aci, 0, '#', &bv) < 0)
1578                 return(0);
1579
1580         /* check that the scope is "entry" */
1581         if (aci_get_part(aci, 1, '#', &bv) < 0
1582                 || aci_strbvcmp( "entry", &bv ) != 0)
1583         {
1584                 return(0);
1585         }
1586
1587         /* get the list of permissions clauses, bail if empty */
1588         if (aci_get_part(aci, 2, '#', &perms) <= 0)
1589                 return(0);
1590
1591         /* check if any permissions allow desired access */
1592         if (aci_list_get_rights(&perms, attr, val, grant, deny) == 0)
1593                 return(0);
1594
1595         /* see if we have a DN match */
1596         if (aci_get_part(aci, 3, '#', &bv) < 0)
1597                 return(0);
1598
1599         if (aci_get_part(aci, 4, '#', &sdn) < 0)
1600                 return(0);
1601
1602         if (aci_strbvcmp( "access-id", &bv ) == 0) {
1603                 struct berval *ndn = NULL;
1604                 rc = 1;
1605                 if ( dnNormalize(NULL, &sdn, &ndn) == LDAP_SUCCESS ) {
1606                         if (strcasecmp(op->o_ndn.bv_val, ndn->bv_val) != 0)
1607                                 rc = 0;
1608                         ber_bvfree(ndn);
1609                 }
1610                 return(rc);
1611         }
1612
1613         if (aci_strbvcmp( "self", &bv ) == 0) {
1614                 if (strcmp(op->o_ndn.bv_val, e->e_ndn) == 0)
1615                         return(1);
1616
1617         } else if (aci_strbvcmp( "dnattr", &bv ) == 0) {
1618                 char *dnattr = aci_bvstrdup(&sdn);
1619                 Attribute *at;
1620                 AttributeDescription *ad = NULL;
1621                 const char *text;
1622
1623                 rc = slap_str2ad( dnattr, &ad, &text );
1624                 ch_free( dnattr );
1625
1626                 if( rc != LDAP_SUCCESS ) {
1627                         return 0;
1628                 }
1629
1630                 rc = 0;
1631
1632                 bv = op->o_ndn;
1633
1634                 for(at = attrs_find( e->e_attrs, ad );
1635                         at != NULL;
1636                         at = attrs_find( at->a_next, ad ) )
1637                 {
1638                         if (value_find( ad, at->a_vals, &bv) == 0 ) {
1639                                 rc = 1;
1640                                 break;
1641                         }
1642                 }
1643
1644                 return rc;
1645
1646
1647         } else if (aci_strbvcmp( "group", &bv ) == 0) {
1648                 if (aci_group_member(&sdn, &GroupClass, &GroupAttr, be, e, conn, op, matches))
1649                         return(1);
1650
1651         } else if (aci_strbvcmp( "role", &bv ) == 0) {
1652                 if (aci_group_member(&sdn, &RoleClass, &RoleAttr, be, e, conn, op, matches))
1653                         return(1);
1654
1655         } else if (aci_strbvcmp( "set", &bv ) == 0) {
1656                 if (aci_match_set(&sdn, be, e, conn, op, 0))
1657                         return(1);
1658
1659         } else if (aci_strbvcmp( "set-ref", &bv ) == 0) {
1660                 if (aci_match_set(&sdn, be, e, conn, op, 1))
1661                         return(1);
1662
1663         }
1664
1665         return(0);
1666 }
1667
1668 #endif  /* SLAPD_ACI_ENABLED */
1669
1670 static void
1671 string_expand(
1672         struct berval *bv,
1673         char *pat,
1674         char *match,
1675         regmatch_t *matches)
1676 {
1677         ber_len_t       size;
1678         char   *sp;
1679         char   *dp;
1680         int     flag;
1681
1682         size = 0;
1683         bv->bv_val[0] = '\0';
1684         bv->bv_len--; /* leave space for lone $ */
1685
1686         flag = 0;
1687         for ( dp = bv->bv_val, sp = pat; size < bv->bv_len && *sp ; sp++) {
1688                 /* did we previously see a $ */
1689                 if (flag) {
1690                         if (*sp == '$') {
1691                                 *dp++ = '$';
1692                                 size++;
1693                         } else if (*sp >= '0' && *sp <= '9' ) {
1694                                 int     n;
1695                                 int     i;
1696                                 int     l;
1697
1698                                 n = *sp - '0';
1699                                 *dp = '\0';
1700                                 i = matches[n].rm_so;
1701                                 l = matches[n].rm_eo;
1702                                 for ( ; size < bv->bv_len && i < l; size++, i++ ) {
1703                                         *dp++ = match[i];
1704                                         size++;
1705                                 }
1706                                 *dp = '\0';
1707                         }
1708                         flag = 0;
1709                 } else {
1710                         if (*sp == '$') {
1711                                 flag = 1;
1712                         } else {
1713                                 *dp++ = *sp;
1714                                 size++;
1715                         }
1716                 }
1717         }
1718
1719         if (flag) {
1720                 /* must have ended with a single $ */
1721                 *dp++ = '$';
1722                 size++;
1723         }
1724
1725         *dp = '\0';
1726         bv->bv_len = size;
1727
1728 #ifdef NEW_LOGGING
1729         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1730                    "string_expand:  pattern = %s\n", pat ));
1731         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL1,
1732                    "string_expand:  expanded = %s\n", bv->bv_val ));
1733 #else
1734         Debug( LDAP_DEBUG_TRACE, "=> string_expand: pattern:  %s\n", pat, 0, 0 );
1735         Debug( LDAP_DEBUG_TRACE, "=> string_expand: expanded: %s\n", bv->bv_val, 0, 0 );
1736 #endif
1737 }
1738
1739 static int
1740 regex_matches(
1741         char *pat,                              /* pattern to expand and match against */
1742         char *str,                              /* string to match against pattern */
1743         char *buf,                              /* buffer with $N expansion variables */
1744         regmatch_t *matches             /* offsets in buffer for $N expansion variables */
1745 )
1746 {
1747         regex_t re;
1748         char newbuf[512];
1749         struct berval bv = {sizeof(newbuf), newbuf};
1750         int     rc;
1751
1752         if(str == NULL) str = "";
1753
1754         string_expand(&bv, pat, buf, matches);
1755         if (( rc = regcomp(&re, newbuf, REG_EXTENDED|REG_ICASE))) {
1756                 char error[512];
1757                 regerror(rc, &re, error, sizeof(error));
1758
1759 #ifdef NEW_LOGGING
1760                 LDAP_LOG(( "aci", LDAP_LEVEL_ERR,
1761                            "regex_matches: compile( \"%s\", \"%s\") failed %s\n",
1762                            pat, str, error ));
1763 #else
1764                 Debug( LDAP_DEBUG_TRACE,
1765                     "compile( \"%s\", \"%s\") failed %s\n",
1766                         pat, str, error );
1767 #endif
1768                 return( 0 );
1769         }
1770
1771         rc = regexec(&re, str, 0, NULL, 0);
1772         regfree( &re );
1773
1774 #ifdef NEW_LOGGING
1775         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1776                    "regex_matches: string:   %s\n", str ));
1777         LDAP_LOG(( "aci", LDAP_LEVEL_DETAIL2,
1778                    "regex_matches: rc:  %d  %s\n",
1779                    rc, rc ? "matches" : "no matches" ));
1780 #else
1781         Debug( LDAP_DEBUG_TRACE,
1782             "=> regex_matches: string:   %s\n", str, 0, 0 );
1783         Debug( LDAP_DEBUG_TRACE,
1784             "=> regex_matches: rc: %d %s\n",
1785                 rc, !rc ? "matches" : "no matches", 0 );
1786 #endif
1787         return( !rc );
1788 }
1789