git.sur5r.net Git - openldap/blob - servers/slapd/aclparse.c

   1 /* aclparse.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2000 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/ctype.h>
  13 #include <ac/regex.h>
  14 #include <ac/socket.h>
  15 #include <ac/string.h>
  16 #include <ac/unistd.h>
  17
  18 #include "slap.h"
  19
  20 static void             split(char *line, int splitchar, char **left, char **right);
  21 static void             access_append(Access **l, Access *a);
  22 static void             acl_usage(void) LDAP_GCCATTR((noreturn));
  23
  24 #ifdef LDAP_DEBUG
  25 static void             print_acl(Backend *be, AccessControl *a);
  26 static void             print_access(Access *b);
  27 #endif
  28
  29 static int
  30 regtest(const char *fname, int lineno, char *pat) {
  31         int e;
  32         regex_t re;
  33
  34         char buf[512];
  35         unsigned size;
  36
  37         char *sp;
  38         char *dp;
  39         int  flag;
  40
  41         sp = pat;
  42         dp = buf;
  43         size = 0;
  44         buf[0] = '\0';
  45
  46         for (size = 0, flag = 0; (size < sizeof(buf)) && *sp; sp++) {
  47                 if (flag) {
  48                         if (*sp == '$'|| (*sp >= '0' && *sp <= '9')) {
  49                                 *dp++ = *sp;
  50                                 size++;
  51                         }
  52                         flag = 0;
  53
  54                 } else {
  55                         if (*sp == '$') {
  56                                 flag = 1;
  57                         } else {
  58                                 *dp++ = *sp;
  59                                 size++;
  60                         }
  61                 }
  62         }
  63
  64         *dp = '\0';
  65         if ( size >= (sizeof(buf)-1) ) {
  66                 fprintf( stderr,
  67                         "%s: line %d: regular expression \"%s\" too large\n",
  68                         fname, lineno, pat );
  69                 acl_usage();
  70         }
  71
  72         if ((e = regcomp(&re, buf, REG_EXTENDED|REG_ICASE))) {
  73                 char error[512];
  74                 regerror(e, &re, error, sizeof(error));
  75                 fprintf( stderr,
  76                         "%s: line %d: regular expression \"%s\" bad because of %s\n",
  77                         fname, lineno, pat, error );
  78                 acl_usage();
  79                 return(0);
  80         }
  81         regfree(&re);
  82         return(1);
  83 }
  84
  85 void
  86 parse_acl(
  87     Backend     *be,
  88     const char  *fname,
  89     int         lineno,
  90     int         argc,
  91     char        **argv
  92 )
  93 {
  94         int             i;
  95         char            *left, *right;
  96         AccessControl   *a;
  97         Access  *b;
  98         int rc;
  99         const char *text;
 100
 101         a = NULL;
 102         for ( i = 1; i < argc; i++ ) {
 103                 /* to clause - select which entries are protected */
 104                 if ( strcasecmp( argv[i], "to" ) == 0 ) {
 105                         if ( a != NULL ) {
 106                                 fprintf( stderr,
 107                 "%s: line %d: only one to clause allowed in access line\n",
 108                                     fname, lineno );
 109                                 acl_usage();
 110                         }
 111                         a = (AccessControl *) ch_calloc( 1, sizeof(AccessControl) );
 112                         a->acl_filter = NULL;
 113                         a->acl_dn_pat = NULL;
 114                         a->acl_attrs  = NULL;
 115                         a->acl_access = NULL;
 116                         a->acl_next   = NULL;
 117                         for ( ++i; i < argc; i++ ) {
 118                                 if ( strcasecmp( argv[i], "by" ) == 0 ) {
 119                                         i--;
 120                                         break;
 121                                 }
 122
 123                                 if ( strcasecmp( argv[i], "*" ) == 0 ) {
 124                                         if( a->acl_dn_pat != NULL ) {
 125                                                 fprintf( stderr,
 126                                                         "%s: line %d: dn pattern"
 127                                                         " already specified in to clause.\n",
 128                                                         fname, lineno );
 129                                                 acl_usage();
 130                                         }
 131
 132                                         a->acl_dn_pat = ch_strdup( "*" );
 133                                         continue;
 134                                 }
 135
 136                                 split( argv[i], '=', &left, &right );
 137
 138                                 if ( strcasecmp( left, "dn" ) == 0 ) {
 139                                         if( a->acl_dn_pat != NULL ) {
 140                                                 fprintf( stderr,
 141                                                         "%s: line %d: dn pattern"
 142                                                         " already specified in to clause.\n",
 143                                                         fname, lineno );
 144                                                 acl_usage();
 145                                         }
 146
 147                                         if ( right == NULL ) {
 148                                                 fprintf( stderr,
 149         "%s: line %d: missing \"=\" in \"%s\" in to clause\n",
 150                                                     fname, lineno, left );
 151                                                 acl_usage();
 152                                         }
 153
 154                                         if( *right == '\0' ) {
 155                                                 a->acl_dn_pat = ch_strdup("anonymous");
 156
 157                                         } else if ( strcmp(right, "*") == 0
 158                                                 || strcmp(right, ".*") == 0
 159                                                 || strcmp(right, ".*$") == 0
 160                                                 || strcmp(right, "^.*") == 0
 161                                                 || strcmp(right, "^.*$$") == 0
 162                                                 || strcmp(right, ".*$$") == 0
 163                                                 || strcmp(right, "^.*$$") == 0 )
 164                                         {
 165                                                 a->acl_dn_pat = ch_strdup( "*" );
 166
 167                                         } else {
 168                                                 a->acl_dn_pat = ch_strdup( right );
 169                                         }
 170
 171                                         continue;
 172                                 }
 173
 174                                 if ( right == NULL || *right == '\0' ) {
 175                                         fprintf( stderr,
 176         "%s: line %d: missing \"=\" in (or value after) \"%s\" in to clause\n",
 177                                             fname, lineno, left );
 178                                         acl_usage();
 179                                 }
 180
 181                                 if ( strcasecmp( left, "filter" ) == 0 ) {
 182                                         if ( (a->acl_filter = str2filter(
 183                                             right )) == NULL ) {
 184                                                 fprintf( stderr,
 185                                 "%s: line %d: bad filter \"%s\" in to clause\n",
 186                                                     fname, lineno, right );
 187                                                 acl_usage();
 188                                         }
 189
 190                                 } else if ( strncasecmp( left, "attr", 4 ) == 0 ) {
 191                                         char    **alist;
 192
 193                                         alist = str2charray( right, "," );
 194                                         charray_merge( &a->acl_attrs, alist );
 195                                         charray_free( alist );
 196
 197                                 } else {
 198                                         fprintf( stderr,
 199                                                 "%s: line %d: expecting <what> got \"%s\"\n",
 200                                             fname, lineno, left );
 201                                         acl_usage();
 202                                 }
 203                         }
 204
 205                         if ( a->acl_dn_pat != NULL && strcmp(a->acl_dn_pat, "*") == 0) {
 206                                 free( a->acl_dn_pat );
 207                                 a->acl_dn_pat = NULL;
 208                         }
 209
 210                         if( a->acl_dn_pat != NULL ) {
 211                                 int e = regcomp( &a->acl_dn_re, a->acl_dn_pat,
 212                                                  REG_EXTENDED | REG_ICASE );
 213                                 if ( e ) {
 214                                         char buf[512];
 215                                         regerror( e, &a->acl_dn_re, buf, sizeof(buf) );
 216                                         fprintf( stderr,
 217                                 "%s: line %d: regular expression \"%s\" bad because of %s\n",
 218                                                  fname, lineno, right, buf );
 219                                         acl_usage();
 220                                 }
 221                         }
 222
 223                 /* by clause - select who has what access to entries */
 224                 } else if ( strcasecmp( argv[i], "by" ) == 0 ) {
 225                         if ( a == NULL ) {
 226                                 fprintf( stderr,
 227                                         "%s: line %d: to clause required before by clause in access line\n",
 228                                     fname, lineno );
 229                                 acl_usage();
 230                         }
 231
 232                         /*
 233                          * by clause consists of <who> and <access>
 234                          */
 235
 236                         b = (Access *) ch_calloc( 1, sizeof(Access) );
 237
 238                         ACL_INVALIDATE( b->a_mask );
 239
 240                         if ( ++i == argc ) {
 241                                 fprintf( stderr,
 242                             "%s: line %d: premature eol: expecting <who>\n",
 243                                     fname, lineno );
 244                                 acl_usage();
 245                         }
 246
 247                         /* get <who> */
 248                         for ( ; i < argc; i++ ) {
 249                                 char *pat;
 250                                 split( argv[i], '=', &left, &right );
 251
 252                                 if ( strcasecmp( argv[i], "*" ) == 0 ) {
 253                                         pat = ch_strdup( "*" );
 254
 255                                 } else if ( strcasecmp( argv[i], "anonymous" ) == 0 ) {
 256                                         pat = ch_strdup( "anonymous" );
 257
 258                                 } else if ( strcasecmp( argv[i], "self" ) == 0 ) {
 259                                         pat = ch_strdup( "self" );
 260
 261                                 } else if ( strcasecmp( argv[i], "users" ) == 0 ) {
 262                                         pat = ch_strdup( "users" );
 263
 264                                 } else if ( strcasecmp( left, "dn" ) == 0 ) {
 265                                         if( right == NULL ) {
 266                                                 /* no '=' */
 267                                                 pat = ch_strdup( "users" );
 268
 269                                         } else if (*right == '\0' ) {
 270                                                 /* dn="" */
 271                                                 pat = ch_strdup( "anonymous" );
 272
 273                                         } else if ( strcmp( right, "*" ) == 0 ) {
 274                                                 /* dn=* */
 275                                                 /* any or users?  users for now */
 276                                                 pat = ch_strdup( "users" );
 277
 278                                         } else if ( strcmp( right, ".+" ) == 0
 279                                                 || strcmp( right, "^.+" ) == 0
 280                                                 || strcmp( right, ".+$" ) == 0
 281                                                 || strcmp( right, "^.+$" ) == 0
 282                                                 || strcmp( right, ".+$$" ) == 0
 283                                                 || strcmp( right, "^.+$$" ) == 0 )
 284                                         {
 285                                                 pat = ch_strdup( "users" );
 286
 287                                         } else if ( strcmp( right, ".*" ) == 0
 288                                                 || strcmp( right, "^.*" ) == 0
 289                                                 || strcmp( right, ".*$" ) == 0
 290                                                 || strcmp( right, "^.*$" ) == 0
 291                                                 || strcmp( right, ".*$$" ) == 0
 292                                                 || strcmp( right, "^.*$$" ) == 0 )
 293                                         {
 294                                                 pat = ch_strdup( "*" );
 295
 296                                         } else {
 297                                                 regtest(fname, lineno, right);
 298                                                 pat = ch_strdup( right );
 299                                         }
 300
 301                                 } else {
 302                                         pat = NULL;
 303                                 }
 304
 305                                 if( pat != NULL ) {
 306                                         if( b->a_dn_pat != NULL ) {
 307                                                 fprintf( stderr,
 308                                                     "%s: line %d: dn pattern already specified.\n",
 309                                                     fname, lineno );
 310                                                 acl_usage();
 311                                         }
 312
 313                                         b->a_dn_pat = pat;
 314                                         continue;
 315                                 }
 316
 317                                 if ( strcasecmp( left, "dnattr" ) == 0 ) {
 318                                         if( b->a_dn_at != NULL ) {
 319                                                 fprintf( stderr,
 320                                                         "%s: line %d: dnattr already specified.\n",
 321                                                         fname, lineno );
 322                                                 acl_usage();
 323                                         }
 324
 325                                         rc = slap_str2ad( right, &b->a_dn_at, &text );
 326
 327                                         if( rc != LDAP_SUCCESS ) {
 328                                                 fprintf( stderr,
 329                                                         "%s: line %d: dnattr \"%s\": %s\n",
 330                                                         fname, lineno, right, text );
 331                                                 acl_usage();
 332                                         }
 333
 334
 335                                         if( !is_at_syntax( b->a_dn_at->ad_type,
 336                                                 SLAPD_DN_SYNTAX ) )
 337                                         {
 338                                                 fprintf( stderr,
 339                                                         "%s: line %d: dnattr \"%s\": "
 340                                                         "inappropriate syntax: %s\n",
 341                                                         fname, lineno, right,
 342                                                         b->a_dn_at->ad_type->sat_syntax_oid );
 343                                                 acl_usage();
 344                                         }
 345
 346                                         continue;
 347                                 }
 348
 349                                 if ( strncasecmp( left, "group", sizeof("group")-1 ) == 0 ) {
 350                                         char *name = NULL;
 351                                         char *value = NULL;
 352
 353                                         if( b->a_group_pat != NULL ) {
 354                                                 fprintf( stderr,
 355                                                         "%s: line %d: group pattern already specified.\n",
 356                                                         fname, lineno );
 357                                                 acl_usage();
 358                                         }
 359
 360                                         /* format of string is "group/objectClassValue/groupAttrName" */
 361                                         if ((value = strchr(left, '/')) != NULL) {
 362                                                 *value++ = '\0';
 363                                                 if (*value
 364                                                         && (name = strchr(value, '/')) != NULL)
 365                                                 {
 366                                                         *name++ = '\0';
 367                                                 }
 368                                         }
 369
 370                                         regtest(fname, lineno, right);
 371                                         b->a_group_pat = ch_strdup( right );
 372
 373                                         if (value && *value) {
 374                                                 b->a_group_oc = oc_find( value );
 375                                                 *--value = '/';
 376
 377                                                 if( b->a_group_oc == NULL ) {
 378                                                         fprintf( stderr,
 379                                                                 "%s: line %d: group objectclass "
 380                                                                 "\"%s\" unknown\n",
 381                                                                 fname, lineno, value );
 382                                                         acl_usage();
 383                                                 }
 384                                         } else {
 385                                                 b->a_group_oc = oc_find(SLAPD_GROUP_CLASS);
 386
 387                                                 if( b->a_group_oc == NULL ) {
 388                                                         fprintf( stderr,
 389                                                                 "%s: line %d: group default objectclass "
 390                                                                 "\"%s\" unknown\n",
 391                                                                 fname, lineno, SLAPD_GROUP_CLASS );
 392                                                         acl_usage();
 393                                                 }
 394                                         }
 395
 396 #if 0
 397                                         if( is_object_subclass( b->a_group_oc,
 398                                                 slap_schema.si_oc_referral ) )
 399                                         {
 400                                                 fprintf( stderr,
 401                                                         "%s: line %d: group objectclass \"%s\" "
 402                                                         "is subclass of referral\n",
 403                                                         fname, lineno, value );
 404                                                 acl_usage();
 405                                         }
 406
 407                                         if( is_object_subclass( b->a_group_oc,
 408                                                 slap_schema.si_oc_alias ) )
 409                                         {
 410                                                 fprintf( stderr,
 411                                                         "%s: line %d: group objectclass \"%s\" "
 412                                                         "is subclass of alias\n",
 413                                                         fname, lineno, value );
 414                                                 acl_usage();
 415                                         }
 416 #endif
 417
 418                                         if (name && *name) {
 419                                                 rc = slap_str2ad( right, &b->a_group_at, &text );
 420
 421                                                 if( rc != LDAP_SUCCESS ) {
 422                                                         fprintf( stderr,
 423                                                                 "%s: line %d: group \"%s\": %s\n",
 424                                                                 fname, lineno, right, text );
 425                                                         acl_usage();
 426                                                 }
 427                                                 *--name = '/';
 428                                         } else {
 429                                                 rc = slap_str2ad( SLAPD_GROUP_ATTR, &b->a_group_at, &text );
 430
 431                                                 if( rc != LDAP_SUCCESS ) {
 432                                                         fprintf( stderr,
 433                                                                 "%s: line %d: group \"%s\": %s\n",
 434                                                                 fname, lineno, SLAPD_GROUP_ATTR, text );
 435                                                         acl_usage();
 436                                                 }
 437                                         }
 438
 439                                         if( !is_at_syntax( b->a_group_at->ad_type,
 440                                                 SLAPD_DN_SYNTAX ) )
 441                                         {
 442                                                 fprintf( stderr,
 443                                                         "%s: line %d: group \"%s\": inappropriate syntax: %s\n",
 444                                                         fname, lineno, right,
 445                                                         b->a_group_at->ad_type->sat_syntax_oid );
 446                                                 acl_usage();
 447                                         }
 448
 449
 450                                         {
 451                                                 int rc;
 452                                                 struct berval val;
 453                                                 struct berval *vals[2];
 454
 455                                                 val.bv_val = b->a_group_oc->soc_oid;
 456                                                 val.bv_len = strlen(val.bv_val);
 457                                                 vals[0] = &val;
 458                                                 vals[1] = NULL;
 459
 460
 461                                                 rc = oc_check_allowed( b->a_group_at->ad_type, vals );
 462
 463                                                 if( rc != 0 ) {
 464                                                         fprintf( stderr,
 465                                                                 "%s: line %d: group: \"%s\" not allowed by \"%s\"\n",
 466                                                                 fname, lineno,
 467                                                                 b->a_group_at->ad_cname->bv_val,
 468                                                                 b->a_group_oc->soc_oid );
 469                                                         acl_usage();
 470                                                 }
 471                                         }
 472                                         continue;
 473                                 }
 474
 475                                 if ( strcasecmp( left, "peername" ) == 0 ) {
 476                                         if( b->a_peername_pat != NULL ) {
 477                                                 fprintf( stderr,
 478                                                         "%s: line %d: peername pattern already specified.\n",
 479                                                         fname, lineno );
 480                                                 acl_usage();
 481                                         }
 482
 483                                         regtest(fname, lineno, right);
 484                                         b->a_peername_pat = ch_strdup( right );
 485                                         continue;
 486                                 }
 487
 488                                 if ( strcasecmp( left, "sockname" ) == 0 ) {
 489                                         if( b->a_sockname_pat != NULL ) {
 490                                                 fprintf( stderr,
 491                                                         "%s: line %d: sockname pattern already specified.\n",
 492                                                         fname, lineno );
 493                                                 acl_usage();
 494                                         }
 495
 496                                         regtest(fname, lineno, right);
 497                                         b->a_sockname_pat = ch_strdup( right );
 498                                         continue;
 499                                 }
 500
 501                                 if ( strcasecmp( left, "domain" ) == 0 ) {
 502                                         if( b->a_domain_pat != NULL ) {
 503                                                 fprintf( stderr,
 504                                                         "%s: line %d: domain pattern already specified.\n",
 505                                                         fname, lineno );
 506                                                 acl_usage();
 507                                         }
 508
 509                                         regtest(fname, lineno, right);
 510                                         b->a_domain_pat = ch_strdup( right );
 511                                         continue;
 512                                 }
 513
 514                                 if ( strcasecmp( left, "sockurl" ) == 0 ) {
 515                                         if( b->a_sockurl_pat != NULL ) {
 516                                                 fprintf( stderr,
 517                                                         "%s: line %d: sockurl pattern already specified.\n",
 518                                                         fname, lineno );
 519                                                 acl_usage();
 520                                         }
 521
 522                                         regtest(fname, lineno, right);
 523                                         b->a_sockurl_pat = ch_strdup( right );
 524                                         continue;
 525                                 }
 526
 527 #ifdef SLAPD_ACI_ENABLED
 528                                 if ( strcasecmp( left, "aci" ) == 0 ) {
 529                                         if( b->a_aci_at != NULL ) {
 530                                                 fprintf( stderr,
 531                                                         "%s: line %d: aci attribute already specified.\n",
 532                                                         fname, lineno );
 533                                                 acl_usage();
 534                                         }
 535
 536                                         if ( right != NULL && *right != '\0' ) {
 537                                                 rc = slap_str2ad( right, &b->a_aci_at, &text );
 538
 539                                                 if( rc != LDAP_SUCCESS ) {
 540                                                         fprintf( stderr,
 541                                                                 "%s: line %d: aci \"%s\": %s\n",
 542                                                                 fname, lineno, right, text );
 543                                                         acl_usage();
 544                                                 }
 545
 546                                         } else {
 547                                                 rc = slap_str2ad( SLAPD_ACI_ATTR, &b->a_aci_at, &text );
 548
 549                                                 if( rc != LDAP_SUCCESS ) {
 550                                                         fprintf( stderr,
 551                                                                 "%s: line %d: aci \"%s\": %s\n",
 552                                                                 fname, lineno, SLAPD_ACI_ATTR, text );
 553                                                         acl_usage();
 554                                                 }
 555                                         }
 556
 557                                         if( !is_at_syntax( b->a_aci_at->ad_type,
 558                                                 SLAPD_ACI_SYNTAX) )
 559                                         {
 560                                                 fprintf( stderr,
 561                                                         "%s: line %d: aci \"%s\": inappropriate syntax: %s\n",
 562                                                         fname, lineno, right,
 563                                                         b->a_aci_at->ad_type->sat_syntax_oid );
 564                                                 acl_usage();
 565                                         }
 566
 567                                         continue;
 568                                 }
 569 #endif /* SLAPD_ACI_ENABLED */
 570
 571                                 if( right != NULL ) {
 572                                         /* unsplit */
 573                                         right[-1] = '=';
 574                                 }
 575                                 break;
 576                         }
 577
 578                         if( i == argc || ( strcasecmp( left, "stop" ) == 0 )) {
 579                                 /* out of arguments or plain stop */
 580
 581                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 582                                 b->a_type = ACL_STOP;
 583
 584                                 access_append( &a->acl_access, b );
 585                                 continue;
 586                         }
 587
 588                         if( strcasecmp( left, "continue" ) == 0 ) {
 589                                 /* plain continue */
 590
 591                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 592                                 b->a_type = ACL_CONTINUE;
 593
 594                                 access_append( &a->acl_access, b );
 595                                 continue;
 596                         }
 597
 598                         if( strcasecmp( left, "break" ) == 0 ) {
 599                                 /* plain continue */
 600
 601                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 602                                 b->a_type = ACL_BREAK;
 603
 604                                 access_append( &a->acl_access, b );
 605                                 continue;
 606                         }
 607
 608                         if ( strcasecmp( left, "by" ) == 0 ) {
 609                                 /* we've gone too far */
 610                                 --i;
 611                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 612                                 b->a_type = ACL_STOP;
 613
 614                                 access_append( &a->acl_access, b );
 615                                 continue;
 616                         }
 617
 618                         /* get <access> */
 619                         if( strncasecmp( left, "self", 4 ) == 0 ) {
 620                                 b->a_dn_self = 1;
 621                                 ACL_PRIV_ASSIGN( b->a_mask, str2accessmask( &left[4] ) );
 622
 623                         } else {
 624                                 ACL_PRIV_ASSIGN( b->a_mask, str2accessmask( left ) );
 625                         }
 626
 627                         if( ACL_IS_INVALID( b->a_mask ) ) {
 628                                 fprintf( stderr,
 629                                         "%s: line %d: expecting <access> got \"%s\"\n",
 630                                         fname, lineno, left );
 631                                 acl_usage();
 632                         }
 633
 634                         b->a_type = ACL_STOP;
 635
 636                         if( ++i == argc ) {
 637                                 /* out of arguments or plain stop */
 638                                 access_append( &a->acl_access, b );
 639                                 continue;
 640                         }
 641
 642                         if( strcasecmp( argv[i], "continue" ) == 0 ) {
 643                                 /* plain continue */
 644                                 b->a_type = ACL_CONTINUE;
 645
 646                         } else if( strcasecmp( argv[i], "break" ) == 0 ) {
 647                                 /* plain continue */
 648                                 b->a_type = ACL_BREAK;
 649
 650                         } else if ( strcasecmp( argv[i], "stop" ) != 0 ) {
 651                                 /* gone to far */
 652                                 i--;
 653                         }
 654
 655                         access_append( &a->acl_access, b );
 656
 657                 } else {
 658                         fprintf( stderr,
 659                     "%s: line %d: expecting \"to\" or \"by\" got \"%s\"\n",
 660                             fname, lineno, argv[i] );
 661                         acl_usage();
 662                 }
 663         }
 664
 665         /* if we have no real access clause, complain and do nothing */
 666         if ( a == NULL ) {
 667                         fprintf( stderr,
 668                                 "%s: line %d: warning: no access clause(s) specified in access line\n",
 669                             fname, lineno );
 670
 671         } else {
 672 #ifdef LDAP_DEBUG
 673                 if (ldap_debug & LDAP_DEBUG_ACL)
 674                         print_acl(be, a);
 675 #endif
 676
 677                 if ( a->acl_access == NULL ) {
 678                         fprintf( stderr,
 679                         "%s: line %d: warning: no by clause(s) specified in access line\n",
 680                             fname, lineno );
 681                 }
 682
 683                 if ( be != NULL ) {
 684                         acl_append( &be->be_acl, a );
 685                 } else {
 686                         acl_append( &global_acl, a );
 687                 }
 688         }
 689 }
 690
 691 char *
 692 accessmask2str( slap_access_mask_t mask, char *buf )
 693 {
 694         int none=1;
 695
 696         assert( buf != NULL );
 697
 698         if ( ACL_IS_INVALID( mask ) ) {
 699                 return "invalid";
 700         }
 701
 702         buf[0] = '\0';
 703
 704         if ( ACL_IS_LEVEL( mask ) ) {
 705                 if ( ACL_LVL_IS_NONE(mask) ) {
 706                         strcat( buf, "none" );
 707
 708                 } else if ( ACL_LVL_IS_AUTH(mask) ) {
 709                         strcat( buf, "auth" );
 710
 711                 } else if ( ACL_LVL_IS_COMPARE(mask) ) {
 712                         strcat( buf, "compare" );
 713
 714                 } else if ( ACL_LVL_IS_SEARCH(mask) ) {
 715                         strcat( buf, "search" );
 716
 717                 } else if ( ACL_LVL_IS_READ(mask) ) {
 718                         strcat( buf, "read" );
 719
 720                 } else if ( ACL_LVL_IS_WRITE(mask) ) {
 721                         strcat( buf, "write" );
 722                 } else {
 723                         strcat( buf, "unknown" );
 724                 }
 725
 726                 strcat(buf, " (");
 727         }
 728
 729         if( ACL_IS_ADDITIVE( mask ) ) {
 730                 strcat( buf, "+" );
 731
 732         } else if( ACL_IS_SUBTRACTIVE( mask ) ) {
 733                 strcat( buf, "-" );
 734
 735         } else {
 736                 strcat( buf, "=" );
 737         }
 738
 739         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_WRITE) ) {
 740                 none = 0;
 741                 strcat( buf, "w" );
 742         }
 743
 744         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_READ) ) {
 745                 none = 0;
 746                 strcat( buf, "r" );
 747         }
 748
 749         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_SEARCH) ) {
 750                 none = 0;
 751                 strcat( buf, "s" );
 752         }
 753
 754         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_COMPARE) ) {
 755                 none = 0;
 756                 strcat( buf, "c" );
 757         }
 758
 759         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_AUTH) ) {
 760                 none = 0;
 761                 strcat( buf, "x" );
 762         }
 763
 764         if ( none && ACL_PRIV_ISSET(mask, ACL_PRIV_NONE) ) {
 765                 none = 0;
 766                 strcat( buf, "n" );
 767         }
 768
 769         if ( none ) {
 770                 strcat( buf, "0" );
 771         }
 772
 773         if ( ACL_IS_LEVEL( mask ) ) {
 774                 strcat(buf, ")");
 775         }
 776         return buf;
 777 }
 778
 779 slap_access_mask_t
 780 str2accessmask( const char *str )
 781 {
 782         slap_access_mask_t      mask;
 783
 784         if( !isalpha(str[0]) ) {
 785                 int i;
 786
 787                 if ( str[0] == '=' ) {
 788                         ACL_INIT(mask);
 789
 790                 } else if( str[0] == '+' ) {
 791                         ACL_PRIV_ASSIGN(mask, ACL_PRIV_ADDITIVE);
 792
 793                 } else if( str[0] == '-' ) {
 794                         ACL_PRIV_ASSIGN(mask, ACL_PRIV_SUBSTRACTIVE);
 795
 796                 } else {
 797                         ACL_INVALIDATE(mask);
 798                         return mask;
 799                 }
 800
 801                 for( i=1; str[i] != '\0'; i++ ) {
 802                         if( TOLOWER(str[i]) == 'w' ) {
 803                                 ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
 804
 805                         } else if( TOLOWER(str[i]) == 'r' ) {
 806                                 ACL_PRIV_SET(mask, ACL_PRIV_READ);
 807
 808                         } else if( TOLOWER(str[i]) == 's' ) {
 809                                 ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
 810
 811                         } else if( TOLOWER(str[i]) == 'c' ) {
 812                                 ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
 813
 814                         } else if( TOLOWER(str[i]) == 'x' ) {
 815                                 ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
 816
 817                         } else if( str[i] != '0' ) {
 818                                 ACL_INVALIDATE(mask);
 819                                 return mask;
 820                         }
 821                 }
 822
 823                 return mask;
 824         }
 825
 826         if ( strcasecmp( str, "none" ) == 0 ) {
 827                 ACL_LVL_ASSIGN_NONE(mask);
 828
 829         } else if ( strcasecmp( str, "auth" ) == 0 ) {
 830                 ACL_LVL_ASSIGN_AUTH(mask);
 831
 832         } else if ( strcasecmp( str, "compare" ) == 0 ) {
 833                 ACL_LVL_ASSIGN_COMPARE(mask);
 834
 835         } else if ( strcasecmp( str, "search" ) == 0 ) {
 836                 ACL_LVL_ASSIGN_SEARCH(mask);
 837
 838         } else if ( strcasecmp( str, "read" ) == 0 ) {
 839                 ACL_LVL_ASSIGN_READ(mask);
 840
 841         } else if ( strcasecmp( str, "write" ) == 0 ) {
 842                 ACL_LVL_ASSIGN_WRITE(mask);
 843
 844         } else {
 845                 ACL_INVALIDATE( mask );
 846         }
 847
 848         return mask;
 849 }
 850
 851 static void
 852 acl_usage( void )
 853 {
 854         fprintf( stderr, "\n"
 855                 "<access clause> ::= access to <what> "
 856                                 "[ by <who> <access> <control> ]+ \n"
 857                 "<what> ::= * | [dn=<regex>] [filter=<ldapfilter>] [attrs=<attrlist>]\n"
 858                 "<attrlist> ::= <attr> | <attr> , <attrlist>\n"
 859                 "<attr> ::= <attrname> | entry | children\n"
 860                 "<who> ::= [ * | anonymous | users | self | dn=<regex> ]\n"
 861                         "\t[dnattr=<attrname>]\n"
 862                         "\t[group[/<objectclass>[/<attrname>]]=<regex>]\n"
 863                         "\t[peername=<regex>] [sockname=<regex>]\n"
 864                         "\t[domain=<regex>] [sockurl=<regex>]\n"
 865 #ifdef SLAPD_ACI_ENABLED
 866                         "\t[aci=<attrname>]\n"
 867 #endif
 868                 "<access> ::= [self]{<level>|<priv>}\n"
 869                 "<level> ::= none | auth | compare | search | read | write\n"
 870                 "<priv> ::= {=|+|-}{w|r|s|c|x}+\n"
 871                 "<control> ::= [ stop | continue | break ]\n"
 872                 );
 873         exit( EXIT_FAILURE );
 874 }
 875
 876 static void
 877 split(
 878     char        *line,
 879     int         splitchar,
 880     char        **left,
 881     char        **right
 882 )
 883 {
 884         *left = line;
 885         if ( (*right = strchr( line, splitchar )) != NULL ) {
 886                 *((*right)++) = '\0';
 887         }
 888 }
 889
 890 static void
 891 access_append( Access **l, Access *a )
 892 {
 893         for ( ; *l != NULL; l = &(*l)->a_next )
 894                 ;       /* NULL */
 895
 896         *l = a;
 897 }
 898
 899 void
 900 acl_append( AccessControl **l, AccessControl *a )
 901 {
 902         for ( ; *l != NULL; l = &(*l)->acl_next )
 903                 ;       /* NULL */
 904
 905         *l = a;
 906 }
 907
 908 char *
 909 access2str( slap_access_t access )
 910 {
 911         if ( access == ACL_NONE ) {
 912                 return "none";
 913
 914         } else if ( access == ACL_AUTH ) {
 915                 return "auth";
 916
 917         } else if ( access == ACL_COMPARE ) {
 918                 return "compare";
 919
 920         } else if ( access == ACL_SEARCH ) {
 921                 return "search";
 922
 923         } else if ( access == ACL_READ ) {
 924                 return "read";
 925
 926         } else if ( access == ACL_WRITE ) {
 927                 return "write";
 928         }
 929
 930         return "unknown";
 931 }
 932
 933 slap_access_t
 934 str2access( const char *str )
 935 {
 936         if ( strcasecmp( str, "none" ) == 0 ) {
 937                 return ACL_NONE;
 938
 939         } else if ( strcasecmp( str, "auth" ) == 0 ) {
 940                 return ACL_AUTH;
 941
 942         } else if ( strcasecmp( str, "compare" ) == 0 ) {
 943                 return ACL_COMPARE;
 944
 945         } else if ( strcasecmp( str, "search" ) == 0 ) {
 946                 return ACL_SEARCH;
 947
 948         } else if ( strcasecmp( str, "read" ) == 0 ) {
 949                 return ACL_READ;
 950
 951         } else if ( strcasecmp( str, "write" ) == 0 ) {
 952                 return ACL_WRITE;
 953         }
 954
 955         return( ACL_INVALID_ACCESS );
 956 }
 957
 958 #ifdef LDAP_DEBUG
 959
 960 static void
 961 print_access( Access *b )
 962 {
 963         char maskbuf[ACCESSMASK_MAXLEN];
 964
 965         fprintf( stderr, "\tby" );
 966
 967         if ( b->a_dn_pat != NULL ) {
 968                 if( strcmp(b->a_dn_pat, "*") == 0
 969                         || strcmp(b->a_dn_pat, "users") == 0
 970                         || strcmp(b->a_dn_pat, "anonymous") == 0
 971                         || strcmp(b->a_dn_pat, "self") == 0 )
 972                 {
 973                         fprintf( stderr, " %s", b->a_dn_pat );
 974
 975                 } else {
 976                         fprintf( stderr, " dn=%s", b->a_dn_pat );
 977                 }
 978         }
 979
 980         if ( b->a_dn_at != NULL ) {
 981                 fprintf( stderr, " dnattr=%s", b->a_dn_at->ad_cname->bv_val );
 982         }
 983
 984         if ( b->a_group_pat != NULL ) {
 985                 fprintf( stderr, " group: %s", b->a_group_pat );
 986
 987                 if ( b->a_group_oc ) {
 988                         fprintf( stderr, " objectClass: %s",
 989                                 b->a_group_oc->soc_oclass.oc_oid );
 990
 991                         if ( b->a_group_at ) {
 992                                 fprintf( stderr, " attributeType: %s", b->a_group_at->ad_cname->bv_val );
 993                         }
 994                 }
 995     }
 996
 997         if ( b->a_peername_pat != NULL ) {
 998                 fprintf( stderr, " peername=%s", b->a_peername_pat );
 999         }
1000
1001         if ( b->a_sockname_pat != NULL ) {
1002                 fprintf( stderr, " sockname=%s", b->a_sockname_pat );
1003         }
1004
1005         if ( b->a_domain_pat != NULL ) {
1006                 fprintf( stderr, " domain=%s", b->a_domain_pat );
1007         }
1008
1009         if ( b->a_sockurl_pat != NULL ) {
1010                 fprintf( stderr, " sockurl=%s", b->a_sockurl_pat );
1011         }
1012
1013 #ifdef SLAPD_ACI_ENABLED
1014         if ( b->a_aci_at != NULL ) {
1015                 fprintf( stderr, " aci=%s", b->a_aci_at->ad_cname->bv_val );
1016         }
1017 #endif
1018
1019         fprintf( stderr, " %s%s",
1020                 b->a_dn_self ? "self" : "",
1021                 accessmask2str( b->a_mask, maskbuf ) );
1022
1023         if( b->a_type == ACL_BREAK ) {
1024                 fprintf( stderr, " break" );
1025
1026         } else if( b->a_type == ACL_CONTINUE ) {
1027                 fprintf( stderr, " continue" );
1028
1029         } else if( b->a_type != ACL_STOP ) {
1030                 fprintf( stderr, " unknown-control" );
1031         }
1032
1033         fprintf( stderr, "\n" );
1034 }
1035
1036
1037 static void
1038 print_acl( Backend *be, AccessControl *a )
1039 {
1040         int             to = 0;
1041         Access  *b;
1042
1043         fprintf( stderr, "%s ACL: access to",
1044                 be == NULL ? "Global" : "Backend" );
1045
1046         if ( a->acl_dn_pat != NULL ) {
1047                 to++;
1048                 fprintf( stderr, " dn=%s\n",
1049                         a->acl_dn_pat );
1050         }
1051
1052         if ( a->acl_filter != NULL ) {
1053                 to++;
1054                 fprintf( stderr, " filter=" );
1055                 filter_print( a->acl_filter );
1056                 fprintf( stderr, "\n" );
1057         }
1058
1059         if ( a->acl_attrs != NULL ) {
1060                 int     i, first = 1;
1061                 to++;
1062
1063                 fprintf( stderr, " attrs=" );
1064                 for ( i = 0; a->acl_attrs[i] != NULL; i++ ) {
1065                         if ( ! first ) {
1066                                 fprintf( stderr, "," );
1067                         }
1068                         fprintf( stderr, a->acl_attrs[i] );
1069                         first = 0;
1070                 }
1071                 fprintf(  stderr, "\n" );
1072         }
1073
1074         if( !to ) {
1075                 fprintf( stderr, " *\n" );
1076         }
1077
1078         for ( b = a->acl_access; b != NULL; b = b->a_next ) {
1079                 print_access( b );
1080         }
1081
1082         fprintf( stderr, "\n" );
1083 }
1084
1085 #endif /* LDAP_DEBUG */