]> git.sur5r.net Git - openldap/blob - servers/slapd/aclparse.c
now I remember why I introduced the 'has_ldapinfo_dn_ru' flag
[openldap] / servers / slapd / aclparse.c
1 /* aclparse.c - routines to parse and check acl's */
2 /* $OpenLDAP$ */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
4  *
5  * Copyright 1998-2004 The OpenLDAP Foundation.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted only as authorized by the OpenLDAP
10  * Public License.
11  *
12  * A copy of this license is available in the file LICENSE in the
13  * top-level directory of the distribution or, alternatively, at
14  * <http://www.OpenLDAP.org/license.html>.
15  */
16 /* Portions Copyright (c) 1995 Regents of the University of Michigan.
17  * All rights reserved.
18  *
19  * Redistribution and use in source and binary forms are permitted
20  * provided that this notice is preserved and that due credit is given
21  * to the University of Michigan at Ann Arbor. The name of the University
22  * may not be used to endorse or promote products derived from this
23  * software without specific prior written permission. This software
24  * is provided ``as is'' without express or implied warranty.
25  */
26
27 #include "portable.h"
28
29 #include <stdio.h>
30
31 #include <ac/ctype.h>
32 #include <ac/regex.h>
33 #include <ac/socket.h>
34 #include <ac/string.h>
35 #include <ac/unistd.h>
36
37 #include "slap.h"
38 #include "lber_pvt.h"
39 #include "lutil.h"
40
41 static char *style_strings[] = { "regex",
42         "base", "one", "subtree", "children", NULL };
43
44 static void             split(char *line, int splitchar, char **left, char **right);
45 static void             access_append(Access **l, Access *a);
46 static void             acl_usage(void) LDAP_GCCATTR((noreturn));
47
48 static void             acl_regex_normalized_dn(const char *src, struct berval *pat);
49
50 #ifdef LDAP_DEBUG
51 static void             print_acl(Backend *be, AccessControl *a);
52 static void             print_access(Access *b);
53 #endif
54
55 static void
56 regtest(const char *fname, int lineno, char *pat) {
57         int e;
58         regex_t re;
59
60         char buf[512];
61         unsigned size;
62
63         char *sp;
64         char *dp;
65         int  flag;
66
67         sp = pat;
68         dp = buf;
69         size = 0;
70         buf[0] = '\0';
71
72         for (size = 0, flag = 0; (size < sizeof(buf)) && *sp; sp++) {
73                 if (flag) {
74                         if (*sp == '$'|| (*sp >= '0' && *sp <= '9')) {
75                                 *dp++ = *sp;
76                                 size++;
77                         }
78                         flag = 0;
79
80                 } else {
81                         if (*sp == '$') {
82                                 flag = 1;
83                         } else {
84                                 *dp++ = *sp;
85                                 size++;
86                         }
87                 }
88         }
89
90         *dp = '\0';
91         if ( size >= (sizeof(buf)-1) ) {
92                 fprintf( stderr,
93                         "%s: line %d: regular expression \"%s\" too large\n",
94                         fname, lineno, pat );
95                 acl_usage();
96         }
97
98         if ((e = regcomp(&re, buf, REG_EXTENDED|REG_ICASE))) {
99                 char error[512];
100                 regerror(e, &re, error, sizeof(error));
101                 fprintf( stderr,
102                         "%s: line %d: regular expression \"%s\" bad because of %s\n",
103                         fname, lineno, pat, error );
104                 acl_usage();
105         }
106         regfree(&re);
107 }
108
109 void
110 parse_acl(
111     Backend     *be,
112     const char  *fname,
113     int         lineno,
114     int         argc,
115     char        **argv
116 )
117 {
118         int             i;
119         char            *left, *right, *style;
120         struct berval   bv;
121         AccessControl   *a;
122         Access  *b;
123         int rc;
124         const char *text;
125
126         a = NULL;
127         for ( i = 1; i < argc; i++ ) {
128                 /* to clause - select which entries are protected */
129                 if ( strcasecmp( argv[i], "to" ) == 0 ) {
130                         if ( a != NULL ) {
131                                 fprintf( stderr, "%s: line %d: "
132                                         "only one to clause allowed in access line\n",
133                                     fname, lineno );
134                                 acl_usage();
135                         }
136                         a = (AccessControl *) ch_calloc( 1, sizeof(AccessControl) );
137                         for ( ++i; i < argc; i++ ) {
138                                 if ( strcasecmp( argv[i], "by" ) == 0 ) {
139                                         i--;
140                                         break;
141                                 }
142
143                                 if ( strcasecmp( argv[i], "*" ) == 0 ) {
144                                         if( a->acl_dn_pat.bv_len ||
145                                                 ( a->acl_dn_style != ACL_STYLE_REGEX ) )
146                                         {
147                                                 fprintf( stderr,
148                                                         "%s: line %d: dn pattern"
149                                                         " already specified in to clause.\n",
150                                                         fname, lineno );
151                                                 acl_usage();
152                                         }
153
154                                         a->acl_dn_pat.bv_val = ch_strdup( "*" );
155                                         a->acl_dn_pat.bv_len = 1;
156                                         continue;
157                                 }
158
159                                 split( argv[i], '=', &left, &right );
160                                 split( left, '.', &left, &style );
161
162                                 if ( right == NULL ) {
163                                         fprintf( stderr, "%s: line %d: "
164                                                 "missing \"=\" in \"%s\" in to clause\n",
165                                             fname, lineno, left );
166                                         acl_usage();
167                                 }
168
169                                 if ( strcasecmp( left, "dn" ) == 0 ) {
170                                         if( a->acl_dn_pat.bv_len != 0 ||
171                                                 ( a->acl_dn_style != ACL_STYLE_REGEX ) )
172                                         {
173                                                 fprintf( stderr,
174                                                         "%s: line %d: dn pattern"
175                                                         " already specified in to clause.\n",
176                                                         fname, lineno );
177                                                 acl_usage();
178                                         }
179
180                                         if ( style == NULL || *style == '\0' ||
181                                                 ( strcasecmp( style, "base" ) == 0 ) ||
182                                                 ( strcasecmp( style, "exact" ) == 0 ))
183                                         {
184                                                 a->acl_dn_style = ACL_STYLE_BASE;
185                                                 ber_str2bv( right, 0, 1, &a->acl_dn_pat );
186
187                                         } else if ( strcasecmp( style, "onelevel" ) == 0
188                                                 || strcasecmp( style, "one" ) == 0 ) {
189                                                 a->acl_dn_style = ACL_STYLE_ONE;
190                                                 ber_str2bv( right, 0, 1, &a->acl_dn_pat );
191
192                                         } else if ( strcasecmp( style, "subtree" ) == 0
193                                                 || strcasecmp( style, "sub" ) == 0 )
194                                         {
195                                                 if( *right == '\0' ) {
196                                                         a->acl_dn_pat.bv_val = ch_strdup( "*" );
197                                                         a->acl_dn_pat.bv_len = 1;
198
199                                                 } else {
200                                                         a->acl_dn_style = ACL_STYLE_SUBTREE;
201                                                         ber_str2bv( right, 0, 1, &a->acl_dn_pat );
202                                                 }
203
204                                         } else if ( strcasecmp( style, "children" ) == 0 ) {
205                                                 a->acl_dn_style = ACL_STYLE_CHILDREN;
206                                                 ber_str2bv( right, 0, 1, &a->acl_dn_pat );
207
208                                         } else if ( strcasecmp( style, "regex" ) == 0 ) {
209                                                 a->acl_dn_style = ACL_STYLE_REGEX;
210
211                                                 if ( *right == '\0' ) {
212                                                         /* empty regex should match empty DN */
213                                                         a->acl_dn_style = ACL_STYLE_BASE;
214                                                         ber_str2bv( right, 0, 1, &a->acl_dn_pat );
215
216                                                 } else if ( strcmp(right, "*") == 0 
217                                                         || strcmp(right, ".*") == 0 
218                                                         || strcmp(right, ".*$") == 0 
219                                                         || strcmp(right, "^.*") == 0 
220                                                         || strcmp(right, "^.*$") == 0
221                                                         || strcmp(right, ".*$$") == 0 
222                                                         || strcmp(right, "^.*$$") == 0 )
223                                                 {
224                                                         a->acl_dn_pat.bv_val = ch_strdup( "*" );
225                                                         a->acl_dn_pat.bv_len = sizeof("*")-1;
226
227                                                 } else {
228                                                         acl_regex_normalized_dn( right, &a->acl_dn_pat );
229                                                 }
230
231                                         } else {
232                                                 fprintf( stderr, "%s: line %d: "
233                                                         "unknown dn style \"%s\" in to clause\n",
234                                                     fname, lineno, style );
235                                                 acl_usage();
236                                         }
237
238                                         continue;
239                                 }
240
241                                 if ( strcasecmp( left, "filter" ) == 0 ) {
242                                         if ( (a->acl_filter = str2filter( right )) == NULL ) {
243                                                 fprintf( stderr,
244                                 "%s: line %d: bad filter \"%s\" in to clause\n",
245                                                     fname, lineno, right );
246                                                 acl_usage();
247                                         }
248
249                                 } else if ( strcasecmp( left, "attr" ) == 0
250                                                 || strcasecmp( left, "attrs" ) == 0 ) {
251                                         a->acl_attrs = str2anlist( a->acl_attrs,
252                                                 right, "," );
253                                         if ( a->acl_attrs == NULL ) {
254                                                 fprintf( stderr,
255                                 "%s: line %d: unknown attr \"%s\" in to clause\n",
256                                                     fname, lineno, right );
257                                                 acl_usage();
258                                         }
259
260                                 } else if ( strncasecmp( left, "val", 3 ) == 0 ) {
261                                         if ( a->acl_attrval.bv_len ) {
262                                                 fprintf( stderr,
263                                 "%s: line %d: attr val already specified in to clause.\n",
264                                                         fname, lineno );
265                                                 acl_usage();
266                                         }
267                                         if ( a->acl_attrs == NULL || a->acl_attrs[1].an_name.bv_val ) {
268                                                 fprintf( stderr,
269                                 "%s: line %d: attr val requires a single attribute.\n",
270                                                         fname, lineno );
271                                                 acl_usage();
272                                         }
273                                         ber_str2bv( right, 0, 1, &a->acl_attrval );
274                                         if ( style && strcasecmp( style, "regex" ) == 0 ) {
275                                                 int e = regcomp( &a->acl_attrval_re, a->acl_attrval.bv_val,
276                                                         REG_EXTENDED | REG_ICASE | REG_NOSUB );
277                                                 if ( e ) {
278                                                         char buf[512];
279                                                         regerror( e, &a->acl_attrval_re, buf, sizeof(buf) );
280                                                         fprintf( stderr, "%s: line %d: "
281                                                                 "regular expression \"%s\" bad because of %s\n",
282                                                                 fname, lineno, right, buf );
283                                                         acl_usage();
284                                                 }
285                                                 a->acl_attrval_style = ACL_STYLE_REGEX;
286                                         } else {
287                                                 /* FIXME: if the attribute has DN syntax,
288                                                  * we might allow one, subtree and children styles as well */
289                                                 if ( !strcasecmp( style, "exact" ) ) {
290                                                         a->acl_attrval_style = ACL_STYLE_BASE;
291
292                                                 } else if ( a->acl_attrs[0].an_desc->ad_type->sat_syntax == slap_schema.si_syn_distinguishedName ) {
293                                                         if ( !strcasecmp( style, "base" ) ) {
294                                                                 a->acl_attrval_style = ACL_STYLE_BASE;
295                                                         } else if ( !strcasecmp( style, "onelevel" ) || !strcasecmp( style, "one" ) ) {
296                                                                 a->acl_attrval_style = ACL_STYLE_ONE;
297                                                         } else if ( !strcasecmp( style, "subtree" ) || !strcasecmp( style, "sub" ) ) {
298                                                                 a->acl_attrval_style = ACL_STYLE_SUBTREE;
299                                                         } else if ( !strcasecmp( style, "children" ) ) {
300                                                                 a->acl_attrval_style = ACL_STYLE_CHILDREN;
301                                                         } else {
302                                                                 fprintf( stderr, 
303                                                                         "%s: line %d: unknown val.<style> \"%s\" "
304                                                                         "for attributeType \"%s\" with DN syntax; using \"base\"\n",
305                                                                         fname, lineno, style,
306                                                                         a->acl_attrs[0].an_desc->ad_cname.bv_val );
307                                                                 a->acl_attrval_style = ACL_STYLE_BASE;
308                                                         }
309                                                         
310                                                 } else {
311                                                         fprintf( stderr, 
312                                                                 "%s: line %d: unknown val.<style> \"%s\" "
313                                                                 "for attributeType \"%s\"; using \"exact\"\n",
314                                                                 fname, lineno, style,
315                                                                 a->acl_attrs[0].an_desc->ad_cname.bv_val );
316                                                         a->acl_attrval_style = ACL_STYLE_BASE;
317                                                 }
318                                         }
319                                         
320                                 } else {
321                                         fprintf( stderr,
322                                                 "%s: line %d: expecting <what> got \"%s\"\n",
323                                             fname, lineno, left );
324                                         acl_usage();
325                                 }
326                         }
327
328                         if ( a->acl_dn_pat.bv_len != 0 &&
329                                 strcmp(a->acl_dn_pat.bv_val, "*") == 0 )
330                         {
331                                 free( a->acl_dn_pat.bv_val );
332                                 a->acl_dn_pat.bv_val = NULL;
333                                 a->acl_dn_pat.bv_len = 0;
334                         }
335                         
336                         if( a->acl_dn_pat.bv_len != 0 ||
337                                 ( a->acl_dn_style != ACL_STYLE_REGEX ) )
338                         {
339                                 if ( a->acl_dn_style != ACL_STYLE_REGEX ) {
340                                         struct berval bv;
341                                         rc = dnNormalize( 0, NULL, NULL, &a->acl_dn_pat, &bv, NULL);
342                                         if ( rc != LDAP_SUCCESS ) {
343                                                 fprintf( stderr,
344                                                         "%s: line %d: bad DN \"%s\" in to DN clause\n",
345                                                         fname, lineno, a->acl_dn_pat.bv_val );
346                                                 acl_usage();
347                                         }
348                                         free( a->acl_dn_pat.bv_val );
349                                         a->acl_dn_pat = bv;
350                                 } else {
351                                         int e = regcomp( &a->acl_dn_re, a->acl_dn_pat.bv_val,
352                                                 REG_EXTENDED | REG_ICASE );
353                                         if ( e ) {
354                                                 char buf[512];
355                                                 regerror( e, &a->acl_dn_re, buf, sizeof(buf) );
356                                                 fprintf( stderr, "%s: line %d: "
357                                                         "regular expression \"%s\" bad because of %s\n",
358                                                         fname, lineno, right, buf );
359                                                 acl_usage();
360                                         }
361                                 }
362                         }
363
364                 /* by clause - select who has what access to entries */
365                 } else if ( strcasecmp( argv[i], "by" ) == 0 ) {
366                         if ( a == NULL ) {
367                                 fprintf( stderr, "%s: line %d: "
368                                         "to clause required before by clause in access line\n",
369                                     fname, lineno );
370                                 acl_usage();
371                         }
372
373                         /*
374                          * by clause consists of <who> and <access>
375                          */
376
377                         b = (Access *) ch_calloc( 1, sizeof(Access) );
378
379                         ACL_INVALIDATE( b->a_access_mask );
380
381                         if ( ++i == argc ) {
382                                 fprintf( stderr,
383                             "%s: line %d: premature eol: expecting <who>\n",
384                                     fname, lineno );
385                                 acl_usage();
386                         }
387
388                         /* get <who> */
389                         for ( ; i < argc; i++ ) {
390                                 slap_style_t sty = ACL_STYLE_REGEX;
391                                 char *style_modifier = NULL;
392                                 int expand = 0;
393
394                                 split( argv[i], '=', &left, &right );
395                                 split( left, '.', &left, &style );
396                                 if ( style ) {
397                                         split( style, ',', &style, &style_modifier);
398                                 }
399
400                                 if ( style == NULL || *style == '\0' ||
401                                         strcasecmp( style, "exact" ) == 0 ||
402                                         strcasecmp( style, "base" ) == 0 )
403                                 {
404                                         sty = ACL_STYLE_BASE;
405
406                                 } else if ( strcasecmp( style, "onelevel" ) == 0 ||
407                                         strcasecmp( style, "one" ) == 0 ) {
408                                         sty = ACL_STYLE_ONE;
409
410                                 } else if ( strcasecmp( style, "subtree" ) == 0 ||
411                                         strcasecmp( style, "sub" ) == 0 )
412                                 {
413                                         sty = ACL_STYLE_SUBTREE;
414
415                                 } else if ( strcasecmp( style, "children" ) == 0 ) {
416                                         sty = ACL_STYLE_CHILDREN;
417
418                                 } else if ( strcasecmp( style, "regex" ) == 0 ) {
419                                         sty = ACL_STYLE_REGEX;
420
421                                 } else {
422                                         fprintf( stderr,
423                                                 "%s: line %d: unknown style \"%s\" in by clause\n",
424                                             fname, lineno, style );
425                                         acl_usage();
426                                 }
427
428                                 if ( style_modifier &&
429                                         strcasecmp( style_modifier, "expand" ) == 0 )
430                                 {
431                                         expand = 1;
432                                 }
433
434                                 if ( strcasecmp( argv[i], "*" ) == 0 ) {
435                                         bv.bv_val = ch_strdup( "*" );
436                                         bv.bv_len = 1;
437                                         sty = ACL_STYLE_REGEX;
438
439                                 } else if ( strcasecmp( argv[i], "anonymous" ) == 0 ) {
440                                         ber_str2bv("anonymous", sizeof("anonymous")-1, 1, &bv);
441                                         sty = ACL_STYLE_REGEX;
442
443                                 } else if ( strcasecmp( argv[i], "self" ) == 0 ) {
444                                         ber_str2bv("self", sizeof("self")-1, 1, &bv);
445                                         sty = ACL_STYLE_REGEX;
446
447                                 } else if ( strcasecmp( argv[i], "users" ) == 0 ) {
448                                         ber_str2bv("users", sizeof("users")-1, 1, &bv);
449                                         sty = ACL_STYLE_REGEX;
450
451                                 } else if ( strcasecmp( left, "dn" ) == 0 ) {
452                                         if ( sty == ACL_STYLE_REGEX ) {
453                                                 b->a_dn_style = ACL_STYLE_REGEX;
454                                                 if( right == NULL ) {
455                                                         /* no '=' */
456                                                         ber_str2bv("users",
457                                                                 sizeof("users")-1,
458                                                                 1, &bv);
459                                                 } else if (*right == '\0' ) {
460                                                         /* dn="" */
461                                                         ber_str2bv("anonymous",
462                                                                 sizeof("anonymous")-1,
463                                                                 1, &bv);
464                                                 } else if ( strcmp( right, "*" ) == 0 ) {
465                                                         /* dn=* */
466                                                         /* any or users?  users for now */
467                                                         ber_str2bv("users",
468                                                                 sizeof("users")-1,
469                                                                 1, &bv);
470                                                 } else if ( strcmp( right, ".+" ) == 0
471                                                         || strcmp( right, "^.+" ) == 0
472                                                         || strcmp( right, ".+$" ) == 0
473                                                         || strcmp( right, "^.+$" ) == 0
474                                                         || strcmp( right, ".+$$" ) == 0
475                                                         || strcmp( right, "^.+$$" ) == 0 )
476                                                 {
477                                                         ber_str2bv("users",
478                                                                 sizeof("users")-1,
479                                                                 1, &bv);
480                                                 } else if ( strcmp( right, ".*" ) == 0
481                                                         || strcmp( right, "^.*" ) == 0
482                                                         || strcmp( right, ".*$" ) == 0
483                                                         || strcmp( right, "^.*$" ) == 0
484                                                         || strcmp( right, ".*$$" ) == 0
485                                                         || strcmp( right, "^.*$$" ) == 0 )
486                                                 {
487                                                         ber_str2bv("*",
488                                                                 sizeof("*")-1,
489                                                                 1, &bv);
490
491                                                 } else {
492                                                         acl_regex_normalized_dn( right, &bv );
493                                                         if ( !ber_bvccmp( &bv, '*' ) ) {
494                                                                 regtest(fname, lineno, bv.bv_val);
495                                                         }
496                                                 }
497                                         } else if ( right == NULL || *right == '\0' ) {
498                                                 fprintf( stderr, "%s: line %d: "
499                                                         "missing \"=\" in (or value after) \"%s\" "
500                                                         "in by clause\n",
501                                                     fname, lineno, left );
502                                                 acl_usage();
503
504                                         } else {
505                                                 ber_str2bv( right, 0, 1, &bv );
506                                         }
507
508                                 } else {
509                                         bv.bv_val = NULL;
510                                 }
511
512                                 if( bv.bv_val != NULL ) {
513                                         if( b->a_dn_pat.bv_len != 0 ) {
514                                                 fprintf( stderr,
515                                                     "%s: line %d: dn pattern already specified.\n",
516                                                     fname, lineno );
517                                                 acl_usage();
518                                         }
519
520                                         if ( sty != ACL_STYLE_REGEX && expand == 0 ) {
521                                                 rc = dnNormalize(0, NULL, NULL,
522                                                         &bv, &b->a_dn_pat, NULL);
523                                                 if ( rc != LDAP_SUCCESS ) {
524                                                         fprintf( stderr,
525                                                                 "%s: line %d: bad DN \"%s\" in by DN clause\n",
526                                                                 fname, lineno, bv.bv_val );
527                                                         acl_usage();
528                                                 }
529                                                 free(bv.bv_val);
530                                         } else {
531                                                 b->a_dn_pat = bv;
532                                         }
533                                         b->a_dn_style = sty;
534                                         b->a_dn_expand = expand;
535                                         continue;
536                                 }
537
538                                 if ( strcasecmp( left, "dnattr" ) == 0 ) {
539                                         if ( right == NULL || right[ 0 ] == '\0' ) {
540                                                 fprintf( stderr,
541                                                         "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
542                                                         fname, lineno, left );
543                                                 acl_usage();
544                                         }
545
546                                         if( b->a_dn_at != NULL ) {
547                                                 fprintf( stderr,
548                                                         "%s: line %d: dnattr already specified.\n",
549                                                         fname, lineno );
550                                                 acl_usage();
551                                         }
552
553                                         rc = slap_str2ad( right, &b->a_dn_at, &text );
554
555                                         if( rc != LDAP_SUCCESS ) {
556                                                 fprintf( stderr,
557                                                         "%s: line %d: dnattr \"%s\": %s\n",
558                                                         fname, lineno, right, text );
559                                                 acl_usage();
560                                         }
561
562
563                                         if( !is_at_syntax( b->a_dn_at->ad_type,
564                                                 SLAPD_DN_SYNTAX ) &&
565                                                 !is_at_syntax( b->a_dn_at->ad_type,
566                                                 SLAPD_NAMEUID_SYNTAX ))
567                                         {
568                                                 fprintf( stderr,
569                                                         "%s: line %d: dnattr \"%s\": "
570                                                         "inappropriate syntax: %s\n",
571                                                         fname, lineno, right,
572                                                         b->a_dn_at->ad_type->sat_syntax_oid );
573                                                 acl_usage();
574                                         }
575
576                                         if( b->a_dn_at->ad_type->sat_equality == NULL ) {
577                                                 fprintf( stderr,
578                                                         "%s: line %d: dnattr \"%s\": "
579                                                         "inappropriate matching (no EQUALITY)\n",
580                                                         fname, lineno, right );
581                                                 acl_usage();
582                                         }
583
584                                         continue;
585                                 }
586
587                                 if ( strncasecmp( left, "group", sizeof("group")-1 ) == 0 ) {
588                                         char *name = NULL;
589                                         char *value = NULL;
590
591                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
592                                                 fprintf( stderr, "%s: line %d: "
593                                                         "inappropriate style \"%s\" in by clause\n",
594                                                     fname, lineno, style );
595                                                 acl_usage();
596                                         }
597
598                                         if ( right == NULL || right[ 0 ] == '\0' ) {
599                                                 fprintf( stderr, "%s: line %d: "
600                                                         "missing \"=\" in (or value after) \"%s\" "
601                                                         "in by clause\n",
602                                                         fname, lineno, left );
603                                                 acl_usage();
604                                         }
605
606                                         if( b->a_group_pat.bv_len ) {
607                                                 fprintf( stderr,
608                                                         "%s: line %d: group pattern already specified.\n",
609                                                         fname, lineno );
610                                                 acl_usage();
611                                         }
612
613                                         /* format of string is
614                                                 "group/objectClassValue/groupAttrName" */
615                                         if ((value = strchr(left, '/')) != NULL) {
616                                                 *value++ = '\0';
617                                                 if (*value && (name = strchr(value, '/')) != NULL) {
618                                                         *name++ = '\0';
619                                                 }
620                                         }
621
622                                         b->a_group_style = sty;
623                                         if (sty == ACL_STYLE_REGEX) {
624                                                 acl_regex_normalized_dn( right, &bv );
625                                                 if ( !ber_bvccmp( &bv, '*' ) ) {
626                                                         regtest(fname, lineno, bv.bv_val);
627                                                 }
628                                                 b->a_group_pat = bv;
629                                         } else {
630                                                 ber_str2bv( right, 0, 0, &bv );
631                                                 rc = dnNormalize( 0, NULL, NULL, &bv,
632                                                         &b->a_group_pat, NULL );
633                                                 if ( rc != LDAP_SUCCESS ) {
634                                                         fprintf( stderr,
635                                                                 "%s: line %d: bad DN \"%s\"\n",
636                                                                 fname, lineno, right );
637                                                         acl_usage();
638                                                 }
639                                         }
640
641                                         if (value && *value) {
642                                                 b->a_group_oc = oc_find( value );
643                                                 *--value = '/';
644
645                                                 if( b->a_group_oc == NULL ) {
646                                                         fprintf( stderr,
647                                                                 "%s: line %d: group objectclass "
648                                                                 "\"%s\" unknown\n",
649                                                                 fname, lineno, value );
650                                                         acl_usage();
651                                                 }
652                                         } else {
653                                                 b->a_group_oc = oc_find(SLAPD_GROUP_CLASS);
654
655                                                 if( b->a_group_oc == NULL ) {
656                                                         fprintf( stderr,
657                                                                 "%s: line %d: group default objectclass "
658                                                                 "\"%s\" unknown\n",
659                                                                 fname, lineno, SLAPD_GROUP_CLASS );
660                                                         acl_usage();
661                                                 }
662                                         }
663
664                                         if( is_object_subclass( slap_schema.si_oc_referral,
665                                                 b->a_group_oc ))
666                                         {
667                                                 fprintf( stderr,
668                                                         "%s: line %d: group objectclass \"%s\" "
669                                                         "is subclass of referral\n",
670                                                         fname, lineno, value );
671                                                 acl_usage();
672                                         }
673
674                                         if( is_object_subclass( slap_schema.si_oc_alias,
675                                                 b->a_group_oc ))
676                                         {
677                                                 fprintf( stderr,
678                                                         "%s: line %d: group objectclass \"%s\" "
679                                                         "is subclass of alias\n",
680                                                         fname, lineno, value );
681                                                 acl_usage();
682                                         }
683
684                                         if (name && *name) {
685                                                 rc = slap_str2ad( name, &b->a_group_at, &text );
686
687                                                 if( rc != LDAP_SUCCESS ) {
688                                                         fprintf( stderr,
689                                                                 "%s: line %d: group \"%s\": %s\n",
690                                                                 fname, lineno, right, text );
691                                                         acl_usage();
692                                                 }
693                                                 *--name = '/';
694                                         } else {
695                                                 rc = slap_str2ad( SLAPD_GROUP_ATTR, &b->a_group_at, &text );
696
697                                                 if( rc != LDAP_SUCCESS ) {
698                                                         fprintf( stderr,
699                                                                 "%s: line %d: group \"%s\": %s\n",
700                                                                 fname, lineno, SLAPD_GROUP_ATTR, text );
701                                                         acl_usage();
702                                                 }
703                                         }
704
705                                         if( !is_at_syntax( b->a_group_at->ad_type,
706                                                 SLAPD_DN_SYNTAX ) &&
707                                             !is_at_syntax( b->a_group_at->ad_type,
708                                                 SLAPD_NAMEUID_SYNTAX ) &&
709                                                 !is_at_subtype( b->a_group_at->ad_type, slap_schema.si_ad_labeledURI->ad_type ))
710                                         {
711                                                 fprintf( stderr,
712                                                         "%s: line %d: group \"%s\": inappropriate syntax: %s\n",
713                                                         fname, lineno, right,
714                                                         b->a_group_at->ad_type->sat_syntax_oid );
715                                                 acl_usage();
716                                         }
717
718
719                                         {
720                                                 int rc;
721                                                 struct berval vals[2];
722
723                                                 vals[0].bv_val = b->a_group_oc->soc_oid;
724                                                 vals[0].bv_len = strlen(vals[0].bv_val);
725                                                 vals[1].bv_val = NULL;
726
727
728                                                 rc = oc_check_allowed( b->a_group_at->ad_type,
729                                                         vals, NULL );
730
731                                                 if( rc != 0 ) {
732                                                         fprintf( stderr, "%s: line %d: "
733                                                                 "group: \"%s\" not allowed by \"%s\"\n",
734                                                                 fname, lineno,
735                                                                 b->a_group_at->ad_cname.bv_val,
736                                                                 b->a_group_oc->soc_oid );
737                                                         acl_usage();
738                                                 }
739                                         }
740                                         continue;
741                                 }
742
743                                 if ( strcasecmp( left, "peername" ) == 0 ) {
744                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
745                                                 fprintf( stderr, "%s: line %d: "
746                                                         "inappropriate style \"%s\" in by clause\n",
747                                                     fname, lineno, style );
748                                                 acl_usage();
749                                         }
750
751                                         if ( right == NULL || right[ 0 ] == '\0' ) {
752                                                 fprintf( stderr, "%s: line %d: "
753                                                         "missing \"=\" in (or value after) \"%s\" "
754                                                         "in by clause\n",
755                                                         fname, lineno, left );
756                                                 acl_usage();
757                                         }
758
759                                         if( b->a_peername_pat.bv_len ) {
760                                                 fprintf( stderr, "%s: line %d: "
761                                                         "peername pattern already specified.\n",
762                                                         fname, lineno );
763                                                 acl_usage();
764                                         }
765
766                                         b->a_peername_style = sty;
767                                         if (sty == ACL_STYLE_REGEX) {
768                                                 acl_regex_normalized_dn( right, &bv );
769                                                 if ( !ber_bvccmp( &bv, '*' ) ) {
770                                                         regtest(fname, lineno, bv.bv_val);
771                                                 }
772                                                 b->a_peername_pat = bv;
773                                         } else {
774                                                 ber_str2bv( right, 0, 1, &b->a_peername_pat );
775                                         }
776                                         continue;
777                                 }
778
779                                 if ( strcasecmp( left, "sockname" ) == 0 ) {
780                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
781                                                 fprintf( stderr, "%s: line %d: "
782                                                         "inappropriate style \"%s\" in by clause\n",
783                                                     fname, lineno, style );
784                                                 acl_usage();
785                                         }
786
787                                         if ( right == NULL || right[ 0 ] == '\0' ) {
788                                                 fprintf( stderr, "%s: line %d: "
789                                                         "missing \"=\" in (or value after) \"%s\" "
790                                                         "in by clause\n",
791                                                         fname, lineno, left );
792                                                 acl_usage();
793                                         }
794
795                                         if( b->a_sockname_pat.bv_len ) {
796                                                 fprintf( stderr, "%s: line %d: "
797                                                         "sockname pattern already specified.\n",
798                                                         fname, lineno );
799                                                 acl_usage();
800                                         }
801
802                                         b->a_sockname_style = sty;
803                                         if (sty == ACL_STYLE_REGEX) {
804                                                 acl_regex_normalized_dn( right, &bv );
805                                                 if ( !ber_bvccmp( &bv, '*' ) ) {
806                                                         regtest(fname, lineno, bv.bv_val);
807                                                 }
808                                                 b->a_sockname_pat = bv;
809                                         } else {
810                                                 ber_str2bv( right, 0, 1, &b->a_sockname_pat );
811                                         }
812                                         continue;
813                                 }
814
815                                 if ( strcasecmp( left, "domain" ) == 0 ) {
816                                         switch ( sty ) {
817                                         case ACL_STYLE_REGEX:
818                                         case ACL_STYLE_BASE:
819                                         case ACL_STYLE_SUBTREE:
820                                                 break;
821
822                                         default:
823                                                 fprintf( stderr,
824                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
825                                                     fname, lineno, style );
826                                                 acl_usage();
827                                         }
828
829                                         if ( right == NULL || right[ 0 ] == '\0' ) {
830                                                 fprintf( stderr,
831                                                         "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
832                                                         fname, lineno, left );
833                                                 acl_usage();
834                                         }
835
836                                         if( b->a_domain_pat.bv_len ) {
837                                                 fprintf( stderr,
838                                                         "%s: line %d: domain pattern already specified.\n",
839                                                         fname, lineno );
840                                                 acl_usage();
841                                         }
842
843                                         b->a_domain_style = sty;
844                                         b->a_domain_expand = expand;
845                                         if (sty == ACL_STYLE_REGEX) {
846                                                 acl_regex_normalized_dn( right, &bv );
847                                                 if ( !ber_bvccmp( &bv, '*' ) ) {
848                                                         regtest(fname, lineno, bv.bv_val);
849                                                 }
850                                                 b->a_domain_pat = bv;
851                                         } else {
852                                                 ber_str2bv( right, 0, 1, &b->a_domain_pat );
853                                         }
854                                         continue;
855                                 }
856
857                                 if ( strcasecmp( left, "sockurl" ) == 0 ) {
858                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
859                                                 fprintf( stderr,
860                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
861                                                     fname, lineno, style );
862                                                 acl_usage();
863                                         }
864
865                                         if ( right == NULL || right[ 0 ] == '\0' ) {
866                                                 fprintf( stderr,
867                                                         "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
868                                                         fname, lineno, left );
869                                                 acl_usage();
870                                         }
871
872                                         if( b->a_sockurl_pat.bv_len ) {
873                                                 fprintf( stderr,
874                                                         "%s: line %d: sockurl pattern already specified.\n",
875                                                         fname, lineno );
876                                                 acl_usage();
877                                         }
878
879                                         b->a_sockurl_style = sty;
880                                         if (sty == ACL_STYLE_REGEX) {
881                                                 acl_regex_normalized_dn( right, &bv );
882                                                 if ( !ber_bvccmp( &bv, '*' ) ) {
883                                                         regtest(fname, lineno, bv.bv_val);
884                                                 }
885                                                 b->a_sockurl_pat = bv;
886                                         } else {
887                                                 ber_str2bv( right, 0, 1, &b->a_sockurl_pat );
888                                         }
889                                         continue;
890                                 }
891
892                                 if ( strcasecmp( left, "set" ) == 0 ) {
893                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
894                                                 fprintf( stderr,
895                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
896                                                     fname, lineno, style );
897                                                 acl_usage();
898                                         }
899
900                                         if( b->a_set_pat.bv_len != 0 ) {
901                                                 fprintf( stderr,
902                                                         "%s: line %d: set attribute already specified.\n",
903                                                         fname, lineno );
904                                                 acl_usage();
905                                         }
906
907                                         if ( right == NULL || *right == '\0' ) {
908                                                 fprintf( stderr,
909                                                         "%s: line %d: no set is defined\n",
910                                                         fname, lineno );
911                                                 acl_usage();
912                                         }
913
914                                         b->a_set_style = sty;
915                                         ber_str2bv( right, 0, 1, &b->a_set_pat );
916
917                                         continue;
918                                 }
919
920 #ifdef SLAPD_ACI_ENABLED
921                                 if ( strcasecmp( left, "aci" ) == 0 ) {
922                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
923                                                 fprintf( stderr,
924                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
925                                                     fname, lineno, style );
926                                                 acl_usage();
927                                         }
928
929                                         if( b->a_aci_at != NULL ) {
930                                                 fprintf( stderr,
931                                                         "%s: line %d: aci attribute already specified.\n",
932                                                         fname, lineno );
933                                                 acl_usage();
934                                         }
935
936                                         if ( right != NULL && *right != '\0' ) {
937                                                 rc = slap_str2ad( right, &b->a_aci_at, &text );
938
939                                                 if( rc != LDAP_SUCCESS ) {
940                                                         fprintf( stderr,
941                                                                 "%s: line %d: aci \"%s\": %s\n",
942                                                                 fname, lineno, right, text );
943                                                         acl_usage();
944                                                 }
945
946                                         } else {
947                                                 b->a_aci_at = slap_schema.si_ad_aci;
948                                         }
949
950                                         if( !is_at_syntax( b->a_aci_at->ad_type,
951                                                 SLAPD_ACI_SYNTAX) )
952                                         {
953                                                 fprintf( stderr,
954                                                         "%s: line %d: aci \"%s\": inappropriate syntax: %s\n",
955                                                         fname, lineno, right,
956                                                         b->a_aci_at->ad_type->sat_syntax_oid );
957                                                 acl_usage();
958                                         }
959
960                                         continue;
961                                 }
962 #endif /* SLAPD_ACI_ENABLED */
963
964                                 if ( strcasecmp( left, "ssf" ) == 0 ) {
965                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
966                                                 fprintf( stderr,
967                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
968                                                     fname, lineno, style );
969                                                 acl_usage();
970                                         }
971
972                                         if( b->a_authz.sai_ssf ) {
973                                                 fprintf( stderr,
974                                                         "%s: line %d: ssf attribute already specified.\n",
975                                                         fname, lineno );
976                                                 acl_usage();
977                                         }
978
979                                         if ( right == NULL || *right == '\0' ) {
980                                                 fprintf( stderr,
981                                                         "%s: line %d: no ssf is defined\n",
982                                                         fname, lineno );
983                                                 acl_usage();
984                                         }
985
986                                         b->a_authz.sai_ssf = atoi( right );
987
988                                         if( !b->a_authz.sai_ssf ) {
989                                                 fprintf( stderr,
990                                                         "%s: line %d: invalid ssf value (%s)\n",
991                                                         fname, lineno, right );
992                                                 acl_usage();
993                                         }
994                                         continue;
995                                 }
996
997                                 if ( strcasecmp( left, "transport_ssf" ) == 0 ) {
998                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
999                                                 fprintf( stderr,
1000                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
1001                                                     fname, lineno, style );
1002                                                 acl_usage();
1003                                         }
1004
1005                                         if( b->a_authz.sai_transport_ssf ) {
1006                                                 fprintf( stderr,
1007                                                         "%s: line %d: transport_ssf attribute already specified.\n",
1008                                                         fname, lineno );
1009                                                 acl_usage();
1010                                         }
1011
1012                                         if ( right == NULL || *right == '\0' ) {
1013                                                 fprintf( stderr,
1014                                                         "%s: line %d: no transport_ssf is defined\n",
1015                                                         fname, lineno );
1016                                                 acl_usage();
1017                                         }
1018
1019                                         b->a_authz.sai_transport_ssf = atoi( right );
1020
1021                                         if( !b->a_authz.sai_transport_ssf ) {
1022                                                 fprintf( stderr,
1023                                                         "%s: line %d: invalid transport_ssf value (%s)\n",
1024                                                         fname, lineno, right );
1025                                                 acl_usage();
1026                                         }
1027                                         continue;
1028                                 }
1029
1030                                 if ( strcasecmp( left, "tls_ssf" ) == 0 ) {
1031                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
1032                                                 fprintf( stderr,
1033                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
1034                                                     fname, lineno, style );
1035                                                 acl_usage();
1036                                         }
1037
1038                                         if( b->a_authz.sai_tls_ssf ) {
1039                                                 fprintf( stderr,
1040                                                         "%s: line %d: tls_ssf attribute already specified.\n",
1041                                                         fname, lineno );
1042                                                 acl_usage();
1043                                         }
1044
1045                                         if ( right == NULL || *right == '\0' ) {
1046                                                 fprintf( stderr,
1047                                                         "%s: line %d: no tls_ssf is defined\n",
1048                                                         fname, lineno );
1049                                                 acl_usage();
1050                                         }
1051
1052                                         b->a_authz.sai_tls_ssf = atoi( right );
1053
1054                                         if( !b->a_authz.sai_tls_ssf ) {
1055                                                 fprintf( stderr,
1056                                                         "%s: line %d: invalid tls_ssf value (%s)\n",
1057                                                         fname, lineno, right );
1058                                                 acl_usage();
1059                                         }
1060                                         continue;
1061                                 }
1062
1063                                 if ( strcasecmp( left, "sasl_ssf" ) == 0 ) {
1064                                         if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
1065                                                 fprintf( stderr,
1066                                                         "%s: line %d: inappropriate style \"%s\" in by clause\n",
1067                                                     fname, lineno, style );
1068                                                 acl_usage();
1069                                         }
1070
1071                                         if( b->a_authz.sai_sasl_ssf ) {
1072                                                 fprintf( stderr,
1073                                                         "%s: line %d: sasl_ssf attribute already specified.\n",
1074                                                         fname, lineno );
1075                                                 acl_usage();
1076                                         }
1077
1078                                         if ( right == NULL || *right == '\0' ) {
1079                                                 fprintf( stderr,
1080                                                         "%s: line %d: no sasl_ssf is defined\n",
1081                                                         fname, lineno );
1082                                                 acl_usage();
1083                                         }
1084
1085                                         b->a_authz.sai_sasl_ssf = atoi( right );
1086
1087                                         if( !b->a_authz.sai_sasl_ssf ) {
1088                                                 fprintf( stderr,
1089                                                         "%s: line %d: invalid sasl_ssf value (%s)\n",
1090                                                         fname, lineno, right );
1091                                                 acl_usage();
1092                                         }
1093                                         continue;
1094                                 }
1095
1096                                 if( right != NULL ) {
1097                                         /* unsplit */
1098                                         right[-1] = '=';
1099                                 }
1100                                 break;
1101                         }
1102
1103                         if( i == argc || ( strcasecmp( left, "stop" ) == 0 )) { 
1104                                 /* out of arguments or plain stop */
1105
1106                                 ACL_PRIV_ASSIGN(b->a_access_mask, ACL_PRIV_ADDITIVE);
1107                                 b->a_type = ACL_STOP;
1108
1109                                 access_append( &a->acl_access, b );
1110                                 continue;
1111                         }
1112
1113                         if( strcasecmp( left, "continue" ) == 0 ) {
1114                                 /* plain continue */
1115
1116                                 ACL_PRIV_ASSIGN(b->a_access_mask, ACL_PRIV_ADDITIVE);
1117                                 b->a_type = ACL_CONTINUE;
1118
1119                                 access_append( &a->acl_access, b );
1120                                 continue;
1121                         }
1122
1123                         if( strcasecmp( left, "break" ) == 0 ) {
1124                                 /* plain continue */
1125
1126                                 ACL_PRIV_ASSIGN(b->a_access_mask, ACL_PRIV_ADDITIVE);
1127                                 b->a_type = ACL_BREAK;
1128
1129                                 access_append( &a->acl_access, b );
1130                                 continue;
1131                         }
1132
1133                         if ( strcasecmp( left, "by" ) == 0 ) {
1134                                 /* we've gone too far */
1135                                 --i;
1136                                 ACL_PRIV_ASSIGN(b->a_access_mask, ACL_PRIV_ADDITIVE);
1137                                 b->a_type = ACL_STOP;
1138
1139                                 access_append( &a->acl_access, b );
1140                                 continue;
1141                         }
1142
1143                         /* get <access> */
1144                         if( strncasecmp( left, "self", 4 ) == 0 ) {
1145                                 b->a_dn_self = 1;
1146                                 ACL_PRIV_ASSIGN( b->a_access_mask, str2accessmask( &left[4] ) );
1147
1148                         } else {
1149                                 ACL_PRIV_ASSIGN( b->a_access_mask, str2accessmask( left ) );
1150                         }
1151
1152                         if( ACL_IS_INVALID( b->a_access_mask ) ) {
1153                                 fprintf( stderr,
1154                                         "%s: line %d: expecting <access> got \"%s\"\n",
1155                                         fname, lineno, left );
1156                                 acl_usage();
1157                         }
1158
1159                         b->a_type = ACL_STOP;
1160
1161                         if( ++i == argc ) {
1162                                 /* out of arguments or plain stop */
1163                                 access_append( &a->acl_access, b );
1164                                 continue;
1165                         }
1166
1167                         if( strcasecmp( argv[i], "continue" ) == 0 ) {
1168                                 /* plain continue */
1169                                 b->a_type = ACL_CONTINUE;
1170
1171                         } else if( strcasecmp( argv[i], "break" ) == 0 ) {
1172                                 /* plain continue */
1173                                 b->a_type = ACL_BREAK;
1174
1175                         } else if ( strcasecmp( argv[i], "stop" ) != 0 ) {
1176                                 /* gone to far */
1177                                 i--;
1178                         }
1179
1180                         access_append( &a->acl_access, b );
1181
1182                 } else {
1183                         fprintf( stderr,
1184                     "%s: line %d: expecting \"to\" or \"by\" got \"%s\"\n",
1185                             fname, lineno, argv[i] );
1186                         acl_usage();
1187                 }
1188         }
1189
1190         /* if we have no real access clause, complain and do nothing */
1191         if ( a == NULL ) {
1192                         fprintf( stderr,
1193                                 "%s: line %d: warning: no access clause(s) specified in access line\n",
1194                             fname, lineno );
1195
1196         } else {
1197 #ifdef LDAP_DEBUG
1198                 if (ldap_debug & LDAP_DEBUG_ACL)
1199                         print_acl(be, a);
1200 #endif
1201         
1202                 if ( a->acl_access == NULL ) {
1203                         fprintf( stderr,
1204                         "%s: line %d: warning: no by clause(s) specified in access line\n",
1205                             fname, lineno );
1206                 }
1207
1208                 if ( be != NULL ) {
1209                         acl_append( &be->be_acl, a );
1210                 } else {
1211                         acl_append( &global_acl, a );
1212                 }
1213         }
1214 }
1215
1216 char *
1217 accessmask2str( slap_mask_t mask, char *buf )
1218 {
1219         int none=1;
1220         char *ptr = buf;
1221
1222         assert( buf != NULL );
1223
1224         if ( ACL_IS_INVALID( mask ) ) {
1225                 return "invalid";
1226         }
1227
1228         buf[0] = '\0';
1229
1230         if ( ACL_IS_LEVEL( mask ) ) {
1231                 if ( ACL_LVL_IS_NONE(mask) ) {
1232                         ptr = lutil_strcopy( ptr, "none" );
1233
1234                 } else if ( ACL_LVL_IS_AUTH(mask) ) {
1235                         ptr = lutil_strcopy( ptr, "auth" );
1236
1237                 } else if ( ACL_LVL_IS_COMPARE(mask) ) {
1238                         ptr = lutil_strcopy( ptr, "compare" );
1239
1240                 } else if ( ACL_LVL_IS_SEARCH(mask) ) {
1241                         ptr = lutil_strcopy( ptr, "search" );
1242
1243                 } else if ( ACL_LVL_IS_READ(mask) ) {
1244                         ptr = lutil_strcopy( ptr, "read" );
1245
1246                 } else if ( ACL_LVL_IS_WRITE(mask) ) {
1247                         ptr = lutil_strcopy( ptr, "write" );
1248                 } else {
1249                         ptr = lutil_strcopy( ptr, "unknown" );
1250                 }
1251                 
1252                 *ptr++ = '(';
1253         }
1254
1255         if( ACL_IS_ADDITIVE( mask ) ) {
1256                 *ptr++ = '+';
1257
1258         } else if( ACL_IS_SUBTRACTIVE( mask ) ) {
1259                 *ptr++ = '-';
1260
1261         } else {
1262                 *ptr++ = '=';
1263         }
1264
1265         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_WRITE) ) {
1266                 none = 0;
1267                 *ptr++ = 'w';
1268         } 
1269
1270         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_READ) ) {
1271                 none = 0;
1272                 *ptr++ = 'r';
1273         } 
1274
1275         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_SEARCH) ) {
1276                 none = 0;
1277                 *ptr++ = 's';
1278         } 
1279
1280         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_COMPARE) ) {
1281                 none = 0;
1282                 *ptr++ = 'c';
1283         } 
1284
1285         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_AUTH) ) {
1286                 none = 0;
1287                 *ptr++ = 'x';
1288         } 
1289
1290         if ( none && ACL_PRIV_ISSET(mask, ACL_PRIV_NONE) ) {
1291                 none = 0;
1292                 *ptr++ = 'n';
1293         } 
1294
1295         if ( none ) {
1296                 *ptr++ = '0';
1297         }
1298
1299         if ( ACL_IS_LEVEL( mask ) ) {
1300                 *ptr++ = ')';
1301         }
1302
1303         *ptr = '\0';
1304
1305         return buf;
1306 }
1307
1308 slap_mask_t
1309 str2accessmask( const char *str )
1310 {
1311         slap_mask_t     mask;
1312
1313         if( !ASCII_ALPHA(str[0]) ) {
1314                 int i;
1315
1316                 if ( str[0] == '=' ) {
1317                         ACL_INIT(mask);
1318
1319                 } else if( str[0] == '+' ) {
1320                         ACL_PRIV_ASSIGN(mask, ACL_PRIV_ADDITIVE);
1321
1322                 } else if( str[0] == '-' ) {
1323                         ACL_PRIV_ASSIGN(mask, ACL_PRIV_SUBSTRACTIVE);
1324
1325                 } else {
1326                         ACL_INVALIDATE(mask);
1327                         return mask;
1328                 }
1329
1330                 for( i=1; str[i] != '\0'; i++ ) {
1331                         if( TOLOWER((unsigned char) str[i]) == 'w' ) {
1332                                 ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
1333
1334                         } else if( TOLOWER((unsigned char) str[i]) == 'r' ) {
1335                                 ACL_PRIV_SET(mask, ACL_PRIV_READ);
1336
1337                         } else if( TOLOWER((unsigned char) str[i]) == 's' ) {
1338                                 ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
1339
1340                         } else if( TOLOWER((unsigned char) str[i]) == 'c' ) {
1341                                 ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
1342
1343                         } else if( TOLOWER((unsigned char) str[i]) == 'x' ) {
1344                                 ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
1345
1346                         } else if( str[i] != '0' ) {
1347                                 ACL_INVALIDATE(mask);
1348                                 return mask;
1349                         }
1350                 }
1351
1352                 return mask;
1353         }
1354
1355         if ( strcasecmp( str, "none" ) == 0 ) {
1356                 ACL_LVL_ASSIGN_NONE(mask);
1357
1358         } else if ( strcasecmp( str, "auth" ) == 0 ) {
1359                 ACL_LVL_ASSIGN_AUTH(mask);
1360
1361         } else if ( strcasecmp( str, "compare" ) == 0 ) {
1362                 ACL_LVL_ASSIGN_COMPARE(mask);
1363
1364         } else if ( strcasecmp( str, "search" ) == 0 ) {
1365                 ACL_LVL_ASSIGN_SEARCH(mask);
1366
1367         } else if ( strcasecmp( str, "read" ) == 0 ) {
1368                 ACL_LVL_ASSIGN_READ(mask);
1369
1370         } else if ( strcasecmp( str, "write" ) == 0 ) {
1371                 ACL_LVL_ASSIGN_WRITE(mask);
1372
1373         } else {
1374                 ACL_INVALIDATE( mask );
1375         }
1376
1377         return mask;
1378 }
1379
1380 static void
1381 acl_usage( void )
1382 {
1383         fprintf( stderr, "%s%s\n",
1384                 "<access clause> ::= access to <what> "
1385                                 "[ by <who> <access> [ <control> ] ]+ \n"
1386                 "<what> ::= * | [dn[.<dnstyle>]=<DN>] [filter=<filter>] [attrs=<attrlist>]\n"
1387                 "<attrlist> ::= <attr> [val[.<style>]=<value>] | <attr> , <attrlist>\n"
1388                 "<attr> ::= <attrname> | entry | children\n"
1389                 "<who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ]\n"
1390                         "\t[dnattr=<attrname>]\n"
1391                         "\t[group[/<objectclass>[/<attrname>]][.<style>]=<group>]\n"
1392                         "\t[peername[.<style>]=<peer>] [sockname[.<style>]=<name>]\n",
1393                         "\t[domain[.<style>]=<domain>] [sockurl[.<style>]=<url>]\n"
1394 #ifdef SLAPD_ACI_ENABLED
1395                         "\t[aci=<attrname>]\n"
1396 #endif
1397                         "\t[ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]\n"
1398                 "<dnstyle> ::= base | exact | one | subtree | children | regex\n"
1399                 "<style> ::= regex | base | exact\n"
1400                 "<access> ::= [self]{<level>|<priv>}\n"
1401                 "<level> ::= none | auth | compare | search | read | write\n"
1402                 "<priv> ::= {=|+|-}{w|r|s|c|x|0}+\n"
1403                 "<control> ::= [ stop | continue | break ]\n"
1404         );
1405         exit( EXIT_FAILURE );
1406 }
1407
1408 /*
1409  * Set pattern to a "normalized" DN from src.
1410  * At present it simply eats the (optional) space after 
1411  * a RDN separator (,)
1412  * Eventually will evolve in a more complete normalization
1413  */
1414 static void
1415 acl_regex_normalized_dn(
1416         const char *src,
1417         struct berval *pattern
1418 )
1419 {
1420         char *str, *p;
1421         ber_len_t len;
1422
1423         str = ch_strdup( src );
1424         len = strlen( src );
1425
1426         for ( p = str; p && p[ 0 ]; p++ ) {
1427                 /* escape */
1428                 if ( p[ 0 ] == '\\' && p[ 1 ] ) {
1429                         /* 
1430                          * if escaping a hex pair we should
1431                          * increment p twice; however, in that 
1432                          * case the second hex number does 
1433                          * no harm
1434                          */
1435                         p++;
1436                 }
1437
1438                 if ( p[ 0 ] == ',' ) {
1439                         if ( p[ 1 ] == ' ' ) {
1440                                 char *q;
1441                         
1442                                 /*
1443                                  * too much space should be 
1444                                  * an error if we are pedantic
1445                                  */
1446                                 for ( q = &p[ 2 ]; q[ 0 ] == ' '; q++ ) {
1447                                         /* DO NOTHING */ ;
1448                                 }
1449                                 AC_MEMCPY( p+1, q, len-(q-str)+1);
1450                         }
1451                 }
1452         }
1453         pattern->bv_val = str;
1454         pattern->bv_len = p-str;
1455
1456         return;
1457 }
1458
1459 static void
1460 split(
1461     char        *line,
1462     int         splitchar,
1463     char        **left,
1464     char        **right
1465 )
1466 {
1467         *left = line;
1468         if ( (*right = strchr( line, splitchar )) != NULL ) {
1469                 *((*right)++) = '\0';
1470         }
1471 }
1472
1473 static void
1474 access_append( Access **l, Access *a )
1475 {
1476         for ( ; *l != NULL; l = &(*l)->a_next )
1477                 ;       /* NULL */
1478
1479         *l = a;
1480 }
1481
1482 void
1483 acl_append( AccessControl **l, AccessControl *a )
1484 {
1485         for ( ; *l != NULL; l = &(*l)->acl_next )
1486                 ;       /* NULL */
1487
1488         *l = a;
1489 }
1490
1491 static void
1492 access_free( Access *a )
1493 {
1494         if ( a->a_dn_pat.bv_val )
1495                 free ( a->a_dn_pat.bv_val );
1496         if ( a->a_peername_pat.bv_val )
1497                 free ( a->a_peername_pat.bv_val );
1498         if ( a->a_sockname_pat.bv_val )
1499                 free ( a->a_sockname_pat.bv_val );
1500         if ( a->a_domain_pat.bv_val )
1501                 free ( a->a_domain_pat.bv_val );
1502         if ( a->a_sockurl_pat.bv_val )
1503                 free ( a->a_sockurl_pat.bv_val );
1504         if ( a->a_set_pat.bv_len )
1505                 free ( a->a_set_pat.bv_val );
1506         if ( a->a_group_pat.bv_len )
1507                 free ( a->a_group_pat.bv_val );
1508         free( a );
1509 }
1510
1511 void
1512 acl_free( AccessControl *a )
1513 {
1514         Access *n;
1515         AttributeName *an;
1516
1517         if ( a->acl_filter )
1518                 filter_free( a->acl_filter );
1519         if ( a->acl_dn_pat.bv_len )
1520                 free ( a->acl_dn_pat.bv_val );
1521         if ( a->acl_attrs ) {
1522                 for ( an = a->acl_attrs; an->an_name.bv_val; an++ ) {
1523                         free( an->an_name.bv_val );
1524                 }
1525                 free( a->acl_attrs );
1526         }
1527         for (; a->acl_access; a->acl_access = n) {
1528                 n = a->acl_access->a_next;
1529                 access_free( a->acl_access );
1530         }
1531         free( a );
1532 }
1533
1534 /* Because backend_startup uses acl_append to tack on the global_acl to
1535  * the end of each backend's acl, we cannot just take one argument and
1536  * merrily free our way to the end of the list. backend_destroy calls us
1537  * with the be_acl in arg1, and global_acl in arg2 to give us a stopping
1538  * point. config_destroy calls us with global_acl in arg1 and NULL in
1539  * arg2, so we then proceed to polish off the global_acl.
1540  */
1541 void
1542 acl_destroy( AccessControl *a, AccessControl *end )
1543 {
1544         AccessControl *n;
1545
1546         for (; a && a!= end; a=n) {
1547                 n = a->acl_next;
1548                 acl_free( a );
1549         }
1550 }
1551
1552 char *
1553 access2str( slap_access_t access )
1554 {
1555         if ( access == ACL_NONE ) {
1556                 return "none";
1557
1558         } else if ( access == ACL_AUTH ) {
1559                 return "auth";
1560
1561         } else if ( access == ACL_COMPARE ) {
1562                 return "compare";
1563
1564         } else if ( access == ACL_SEARCH ) {
1565                 return "search";
1566
1567         } else if ( access == ACL_READ ) {
1568                 return "read";
1569
1570         } else if ( access == ACL_WRITE ) {
1571                 return "write";
1572         }
1573
1574         return "unknown";
1575 }
1576
1577 slap_access_t
1578 str2access( const char *str )
1579 {
1580         if ( strcasecmp( str, "none" ) == 0 ) {
1581                 return ACL_NONE;
1582
1583         } else if ( strcasecmp( str, "auth" ) == 0 ) {
1584                 return ACL_AUTH;
1585
1586         } else if ( strcasecmp( str, "compare" ) == 0 ) {
1587                 return ACL_COMPARE;
1588
1589         } else if ( strcasecmp( str, "search" ) == 0 ) {
1590                 return ACL_SEARCH;
1591
1592         } else if ( strcasecmp( str, "read" ) == 0 ) {
1593                 return ACL_READ;
1594
1595         } else if ( strcasecmp( str, "write" ) == 0 ) {
1596                 return ACL_WRITE;
1597         }
1598
1599         return( ACL_INVALID_ACCESS );
1600 }
1601
1602 #ifdef LDAP_DEBUG
1603
1604 static void
1605 print_access( Access *b )
1606 {
1607         char maskbuf[ACCESSMASK_MAXLEN];
1608
1609         fprintf( stderr, "\tby" );
1610
1611         if ( b->a_dn_pat.bv_len != 0 ) {
1612                 if( strcmp(b->a_dn_pat.bv_val, "*") == 0
1613                         || strcmp(b->a_dn_pat.bv_val, "users") == 0 
1614                         || strcmp(b->a_dn_pat.bv_val, "anonymous") == 0 
1615                         || strcmp(b->a_dn_pat.bv_val, "self") == 0 )
1616                 {
1617                         fprintf( stderr, " %s", b->a_dn_pat.bv_val );
1618
1619                 } else {
1620                         fprintf( stderr, " dn.%s=\"%s\"",
1621                                 style_strings[b->a_dn_style], b->a_dn_pat.bv_val );
1622                 }
1623         }
1624
1625         if ( b->a_dn_at != NULL ) {
1626                 fprintf( stderr, " dnattr=%s", b->a_dn_at->ad_cname.bv_val );
1627         }
1628
1629         if ( b->a_group_pat.bv_len ) {
1630                 fprintf( stderr, " group/%s/%s.%s=\"%s\"",
1631                         b->a_group_oc ? b->a_group_oc->soc_cname.bv_val : "groupOfNames",
1632                         b->a_group_at ? b->a_group_at->ad_cname.bv_val : "member",
1633                         style_strings[b->a_group_style],
1634                         b->a_group_pat.bv_val );
1635     }
1636
1637         if ( b->a_peername_pat.bv_len != 0 ) {
1638                 fprintf( stderr, " peername=\"%s\"", b->a_peername_pat.bv_val );
1639         }
1640
1641         if ( b->a_sockname_pat.bv_len != 0 ) {
1642                 fprintf( stderr, " sockname=\"%s\"", b->a_sockname_pat.bv_val );
1643         }
1644
1645         if ( b->a_domain_pat.bv_len != 0 ) {
1646                 fprintf( stderr, " domain=%s", b->a_domain_pat.bv_val );
1647         }
1648
1649         if ( b->a_sockurl_pat.bv_len != 0 ) {
1650                 fprintf( stderr, " sockurl=\"%s\"", b->a_sockurl_pat.bv_val );
1651         }
1652
1653 #ifdef SLAPD_ACI_ENABLED
1654         if ( b->a_aci_at != NULL ) {
1655                 fprintf( stderr, " aci=%s", b->a_aci_at->ad_cname.bv_val );
1656         }
1657 #endif
1658
1659         /* Security Strength Factors */
1660         if ( b->a_authz.sai_ssf ) {
1661                 fprintf( stderr, " ssf=%u",
1662                         b->a_authz.sai_ssf );
1663         }
1664         if ( b->a_authz.sai_transport_ssf ) {
1665                 fprintf( stderr, " transport_ssf=%u",
1666                         b->a_authz.sai_transport_ssf );
1667         }
1668         if ( b->a_authz.sai_tls_ssf ) {
1669                 fprintf( stderr, " tls_ssf=%u",
1670                         b->a_authz.sai_tls_ssf );
1671         }
1672         if ( b->a_authz.sai_sasl_ssf ) {
1673                 fprintf( stderr, " sasl_ssf=%u",
1674                         b->a_authz.sai_sasl_ssf );
1675         }
1676
1677         fprintf( stderr, " %s%s",
1678                 b->a_dn_self ? "self" : "",
1679                 accessmask2str( b->a_access_mask, maskbuf ) );
1680
1681         if( b->a_type == ACL_BREAK ) {
1682                 fprintf( stderr, " break" );
1683
1684         } else if( b->a_type == ACL_CONTINUE ) {
1685                 fprintf( stderr, " continue" );
1686
1687         } else if( b->a_type != ACL_STOP ) {
1688                 fprintf( stderr, " unknown-control" );
1689         }
1690
1691         fprintf( stderr, "\n" );
1692 }
1693
1694
1695 static void
1696 print_acl( Backend *be, AccessControl *a )
1697 {
1698         int             to = 0;
1699         Access  *b;
1700
1701         fprintf( stderr, "%s ACL: access to",
1702                 be == NULL ? "Global" : "Backend" );
1703
1704         if ( a->acl_dn_pat.bv_len != 0 ) {
1705                 to++;
1706                 fprintf( stderr, " dn.%s=\"%s\"\n",
1707                         style_strings[a->acl_dn_style], a->acl_dn_pat.bv_val );
1708         }
1709
1710         if ( a->acl_filter != NULL ) {
1711                 struct berval bv = { 0, NULL };
1712                 to++;
1713                 filter2bv( a->acl_filter, &bv );
1714                 fprintf( stderr, " filter=%s\n", bv.bv_val );
1715                 ch_free( bv.bv_val );
1716         }
1717
1718         if ( a->acl_attrs != NULL ) {
1719                 int     first = 1;
1720                 AttributeName *an;
1721                 to++;
1722
1723                 fprintf( stderr, " attrs=" );
1724                 for ( an = a->acl_attrs; an && an->an_name.bv_val; an++ ) {
1725                         if ( ! first ) {
1726                                 fprintf( stderr, "," );
1727                         }
1728                         if (an->an_oc) {
1729                                 fputc( an->an_oc_exclude ? '!' : '@', stderr);
1730                         }
1731                         fputs( an->an_name.bv_val, stderr );
1732                         first = 0;
1733                 }
1734                 fprintf(  stderr, "\n" );
1735         }
1736
1737         if ( a->acl_attrval.bv_len != 0 ) {
1738                 to++;
1739                 fprintf( stderr, " val.%s=\"%s\"\n",
1740                         style_strings[a->acl_attrval_style], a->acl_attrval.bv_val );
1741
1742         }
1743
1744         if( !to ) {
1745                 fprintf( stderr, " *\n" );
1746         }
1747
1748         for ( b = a->acl_access; b != NULL; b = b->a_next ) {
1749                 print_access( b );
1750         }
1751
1752         fprintf( stderr, "\n" );
1753 }
1754
1755 #endif /* LDAP_DEBUG */