git.sur5r.net Git - openldap/blob - servers/slapd/aclparse.c

   1 /* acl.c - routines to parse and check acl's */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-1999 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 #include "portable.h"
   9
  10 #include <stdio.h>
  11
  12 #include <ac/ctype.h>
  13 #include <ac/regex.h>
  14 #include <ac/socket.h>
  15 #include <ac/string.h>
  16 #include <ac/unistd.h>
  17
  18 #include "slap.h"
  19
  20 static void             split(char *line, int splitchar, char **left, char **right);
  21 static void             access_append(Access **l, Access *a);
  22 static void             acl_usage(void) LDAP_GCCATTR((noreturn));
  23
  24 #ifdef LDAP_DEBUG
  25 static void             print_acl(Backend *be, AccessControl *a);
  26 static void             print_access(Access *b);
  27 #endif
  28
  29 static int
  30 regtest(const char *fname, int lineno, char *pat) {
  31         int e;
  32         regex_t re;
  33
  34         char buf[512];
  35         unsigned size;
  36
  37         char *sp;
  38         char *dp;
  39         int  flag;
  40
  41         sp = pat;
  42         dp = buf;
  43         size = 0;
  44         buf[0] = '\0';
  45
  46         for (size = 0, flag = 0; (size < sizeof(buf)) && *sp; sp++) {
  47                 if (flag) {
  48                         if (*sp == '$'|| (*sp >= '0' && *sp <= '9')) {
  49                                 *dp++ = *sp;
  50                                 size++;
  51                         }
  52                         flag = 0;
  53
  54                 } else {
  55                         if (*sp == '$') {
  56                                 flag = 1;
  57                         } else {
  58                                 *dp++ = *sp;
  59                                 size++;
  60                         }
  61                 }
  62         }
  63
  64         *dp = '\0';
  65         if ( size >= (sizeof(buf)-1) ) {
  66                 fprintf( stderr,
  67                         "%s: line %d: regular expression \"%s\" too large\n",
  68                         fname, lineno, pat );
  69                 acl_usage();
  70         }
  71
  72         if ((e = regcomp(&re, buf, REG_EXTENDED|REG_ICASE))) {
  73                 char error[512];
  74                 regerror(e, &re, error, sizeof(error));
  75                 fprintf( stderr,
  76                         "%s: line %d: regular expression \"%s\" bad because of %s\n",
  77                         fname, lineno, pat, error );
  78                 acl_usage();
  79                 return(0);
  80         }
  81         regfree(&re);
  82         return(1);
  83 }
  84
  85 void
  86 parse_acl(
  87     Backend     *be,
  88     const char  *fname,
  89     int         lineno,
  90     int         argc,
  91     char        **argv
  92 )
  93 {
  94         int             i;
  95         char            *left, *right;
  96         AccessControl   *a;
  97         Access  *b;
  98
  99         a = NULL;
 100         for ( i = 1; i < argc; i++ ) {
 101                 /* to clause - select which entries are protected */
 102                 if ( strcasecmp( argv[i], "to" ) == 0 ) {
 103                         if ( a != NULL ) {
 104                                 fprintf( stderr,
 105                 "%s: line %d: only one to clause allowed in access line\n",
 106                                     fname, lineno );
 107                                 acl_usage();
 108                         }
 109                         a = (AccessControl *) ch_calloc( 1, sizeof(AccessControl) );
 110                         a->acl_filter = NULL;
 111                         a->acl_dn_pat = NULL;
 112                         a->acl_attrs  = NULL;
 113                         a->acl_access = NULL;
 114                         a->acl_next   = NULL;
 115                         for ( ++i; i < argc; i++ ) {
 116                                 if ( strcasecmp( argv[i], "by" ) == 0 ) {
 117                                         i--;
 118                                         break;
 119                                 }
 120
 121                                 if ( strcasecmp( argv[i], "*" ) == 0 ) {
 122                                         a->acl_dn_pat = ch_strdup( ".*" );
 123                                         continue;
 124                                 }
 125
 126                                 split( argv[i], '=', &left, &right );
 127                                 if ( right == NULL || *right == '\0' ) {
 128                                         fprintf( stderr,
 129         "%s: line %d: missing \"=\" in (or value after) \"%s\" in to clause\n",
 130                                             fname, lineno, left );
 131                                         acl_usage();
 132                                 }
 133
 134                                 if ( strcasecmp( left, "filter" ) == 0 ) {
 135                                         if ( (a->acl_filter = str2filter(
 136                                             right )) == NULL ) {
 137                                                 fprintf( stderr,
 138                                 "%s: line %d: bad filter \"%s\" in to clause\n",
 139                                                     fname, lineno, right );
 140                                                 acl_usage();
 141                                         }
 142
 143                                 } else if ( strcasecmp( left, "dn" ) == 0 ) {
 144                                                 a->acl_dn_pat = ch_strdup( right );
 145
 146                                 } else if ( strncasecmp( left, "attr", 4 ) == 0 ) {
 147                                         char    **alist;
 148
 149                                         alist = str2charray( right, "," );
 150                                         charray_merge( &a->acl_attrs, alist );
 151                                         charray_free( alist );
 152
 153                                 } else {
 154                                         fprintf( stderr,
 155                                                 "%s: line %d: expecting <what> got \"%s\"\n",
 156                                             fname, lineno, left );
 157                                         acl_usage();
 158                                 }
 159                         }
 160
 161                         if ( a->acl_dn_pat != NULL ) {
 162                                 int e = regcomp( &a->acl_dn_re, a->acl_dn_pat,
 163                                                  REG_EXTENDED | REG_ICASE );
 164                                 if ( e ) {
 165                                         char buf[512];
 166                                         regerror( e, &a->acl_dn_re, buf, sizeof(buf) );
 167                                         fprintf( stderr,
 168                                 "%s: line %d: regular expression \"%s\" bad because of %s\n",
 169                                                  fname, lineno, right, buf );
 170                                         acl_usage();
 171                                 }
 172                         }
 173
 174                 /* by clause - select who has what access to entries */
 175                 } else if ( strcasecmp( argv[i], "by" ) == 0 ) {
 176                         if ( a == NULL ) {
 177                                 fprintf( stderr,
 178                                         "%s: line %d: to clause required before by clause in access line\n",
 179                                     fname, lineno );
 180                                 acl_usage();
 181                         }
 182
 183                         /*
 184                          * by clause consists of <who> and <access>
 185                          */
 186
 187                         b = (Access *) ch_calloc( 1, sizeof(Access) );
 188
 189                         ACL_INVALIDATE( b->a_mask );
 190
 191                         if ( ++i == argc ) {
 192                                 fprintf( stderr,
 193                             "%s: line %d: premature eol: expecting <who>\n",
 194                                     fname, lineno );
 195                                 acl_usage();
 196                         }
 197
 198                         /* get <who> */
 199                         for ( ; i < argc; i++ ) {
 200                                 char *pat;
 201                                 split( argv[i], '=', &left, &right );
 202
 203                                 if ( strcasecmp( argv[i], "*" ) == 0 ) {
 204                                         pat = ch_strdup( ".*" );
 205                                 } else if ( strcasecmp( argv[i], "anonymous" ) == 0 ) {
 206                                         pat = ch_strdup( "anonymous" );
 207                                 } else if ( strcasecmp( argv[i], "self" ) == 0 ) {
 208                                         pat = ch_strdup( "self" );
 209                                 } else if ( strcasecmp( left, "dn" ) == 0 ) {
 210                                         regtest(fname, lineno, right);
 211                                         pat = ch_strdup( right );
 212                                 } else {
 213                                         pat = NULL;
 214                                 }
 215
 216                                 if( pat != NULL ) {
 217                                         if( b->a_dn_pat != NULL ) {
 218                                                 fprintf( stderr,
 219                                                     "%s: line %d: dn pattern already specified.\n",
 220                                                     fname, lineno );
 221                                                 acl_usage();
 222                                         }
 223
 224                                         b->a_dn_pat = pat;
 225                                         continue;
 226                                 }
 227
 228                                 if ( strcasecmp( left, "dnattr" ) == 0 ) {
 229                                         if( b->a_dn_pat != NULL ) {
 230                                                 fprintf( stderr,
 231                                                         "%s: line %d: dnaddr already specified.\n",
 232                                                         fname, lineno );
 233                                                 acl_usage();
 234                                         }
 235
 236                                         b->a_dn_at = ch_strdup( right );
 237                                         continue;
 238                                 }
 239
 240                                 if ( strncasecmp( left, "group", sizeof("group")-1 ) == 0 ) {
 241                                         char *name = NULL;
 242                                         char *value = NULL;
 243
 244                                         if( b->a_group_pat != NULL ) {
 245                                                 fprintf( stderr,
 246                                                         "%s: line %d: group pattern already specified.\n",
 247                                                         fname, lineno );
 248                                                 acl_usage();
 249                                         }
 250
 251                                         /* format of string is "group/objectClassValue/groupAttrName" */
 252                                         if ((value = strchr(left, '/')) != NULL) {
 253                                                 *value++ = '\0';
 254                                                 if (value && *value
 255                                                         && (name = strchr(value, '/')) != NULL)
 256                                                 {
 257                                                         *name++ = '\0';
 258                                                 }
 259                                         }
 260
 261                                         regtest(fname, lineno, right);
 262                                         b->a_group_pat = ch_strdup( right );
 263
 264                                         if (value && *value) {
 265                                                 b->a_group_oc = ch_strdup(value);
 266                                                 *--value = '/';
 267                                         } else {
 268                                                 b->a_group_oc = ch_strdup("groupOfNames");
 269
 270                                                 if (name && *name) {
 271                                                         b->a_group_at = ch_strdup(name);
 272                                                         *--name = '/';
 273
 274                                                 } else {
 275                                                         b->a_group_at = ch_strdup("member");
 276                                                 }
 277                                         }
 278                                         continue;
 279                                 }
 280
 281                                 if ( strcasecmp( left, "peername" ) == 0 ) {
 282                                         if( b->a_peername_pat != NULL ) {
 283                                                 fprintf( stderr,
 284                                                         "%s: line %d: peername pattern already specified.\n",
 285                                                         fname, lineno );
 286                                                 acl_usage();
 287                                         }
 288
 289                                         regtest(fname, lineno, right);
 290                                         b->a_peername_pat = ch_strdup( right );
 291                                         continue;
 292                                 }
 293
 294                                 if ( strcasecmp( left, "sockname" ) == 0 ) {
 295                                         if( b->a_sockname_pat != NULL ) {
 296                                                 fprintf( stderr,
 297                                                         "%s: line %d: sockname pattern already specified.\n",
 298                                                         fname, lineno );
 299                                                 acl_usage();
 300                                         }
 301
 302                                         regtest(fname, lineno, right);
 303                                         b->a_sockname_pat = ch_strdup( right );
 304                                         continue;
 305                                 }
 306
 307                                 if ( strcasecmp( left, "domain" ) == 0 ) {
 308                                         if( b->a_domain_pat != NULL ) {
 309                                                 fprintf( stderr,
 310                                                         "%s: line %d: domain pattern already specified.\n",
 311                                                         fname, lineno );
 312                                                 acl_usage();
 313                                         }
 314
 315                                         regtest(fname, lineno, right);
 316                                         b->a_domain_pat = ch_strdup( right );
 317                                         continue;
 318                                 }
 319
 320                                 if ( strcasecmp( left, "sockurl" ) == 0 ) {
 321                                         if( b->a_sockurl_pat != NULL ) {
 322                                                 fprintf( stderr,
 323                                                         "%s: line %d: sockurl pattern already specified.\n",
 324                                                         fname, lineno );
 325                                                 acl_usage();
 326                                         }
 327
 328                                         regtest(fname, lineno, right);
 329                                         b->a_sockurl_pat = ch_strdup( right );
 330                                         continue;
 331                                 }
 332
 333 #ifdef SLAPD_ACI_ENABLED
 334                                 if ( strcasecmp( left, "aci" ) == 0 ) {
 335                                         if( b->a_aci_at != NULL ) {
 336                                                 fprintf( stderr,
 337                                                         "%s: line %d: aci attribute already specified.\n",
 338                                                         fname, lineno );
 339                                                 acl_usage();
 340                                         }
 341
 342                                         if ( right != NULL && *right != '\0' )
 343                                                 b->a_aci_at = ch_strdup( right );
 344                                         else
 345                                                 b->a_aci_at = ch_strdup( SLAPD_ACI_DEFAULT_ATTR );
 346                                         continue;
 347                                 }
 348 #endif
 349
 350                                 if( right != NULL ) {
 351                                         /* unsplit */
 352                                         right[-1] = '=';
 353                                 }
 354                                 break;
 355                         }
 356
 357                         if( i == argc || ( strcasecmp( left, "stop" ) == 0 )) {
 358                                 /* out of arguments or plain stop */
 359
 360                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 361                                 b->a_type = ACL_STOP;
 362
 363                                 access_append( &a->acl_access, b );
 364                                 continue;
 365                         }
 366
 367                         if( strcasecmp( left, "continue" ) == 0 ) {
 368                                 /* plain continue */
 369
 370                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 371                                 b->a_type = ACL_CONTINUE;
 372
 373                                 access_append( &a->acl_access, b );
 374                                 continue;
 375                         }
 376
 377                         if( strcasecmp( left, "break" ) == 0 ) {
 378                                 /* plain continue */
 379
 380                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 381                                 b->a_type = ACL_BREAK;
 382
 383                                 access_append( &a->acl_access, b );
 384                                 continue;
 385                         }
 386
 387                         if ( strcasecmp( left, "by" ) == 0 ) {
 388                                 /* we've gone too far */
 389                                 --i;
 390                                 ACL_PRIV_ASSIGN(b->a_mask, ACL_PRIV_ADDITIVE);
 391                                 b->a_type = ACL_STOP;
 392
 393                                 access_append( &a->acl_access, b );
 394                                 continue;
 395                         }
 396
 397                         /* get <access> */
 398                         if( strncasecmp( left, "self", 4 ) == 0 ) {
 399                                 b->a_dn_self = 1;
 400                                 ACL_PRIV_ASSIGN( b->a_mask, str2accessmask( &left[4] ) );
 401
 402                         } else {
 403                                 ACL_PRIV_ASSIGN( b->a_mask, str2accessmask( left ) );
 404                         }
 405
 406                         if( ACL_IS_INVALID( b->a_mask ) ) {
 407                                 fprintf( stderr,
 408                                         "%s: line %d: expecting <access> got \"%s\"\n",
 409                                         fname, lineno, left );
 410                                 acl_usage();
 411                         }
 412
 413                         b->a_type = ACL_STOP;
 414
 415                         if( ++i == argc ) {
 416                                 /* out of arguments or plain stop */
 417                                 access_append( &a->acl_access, b );
 418                                 continue;
 419                         }
 420
 421                         if( strcasecmp( argv[i], "continue" ) == 0 ) {
 422                                 /* plain continue */
 423                                 b->a_type = ACL_CONTINUE;
 424
 425                         } else if( strcasecmp( argv[i], "break" ) == 0 ) {
 426                                 /* plain continue */
 427                                 b->a_type = ACL_BREAK;
 428
 429                         } else if ( strcasecmp( argv[i], "stop" ) != 0 ) {
 430                                 /* gone to far */
 431                                 i--;
 432                         }
 433
 434                         access_append( &a->acl_access, b );
 435
 436                 } else {
 437                         fprintf( stderr,
 438                     "%s: line %d: expecting \"to\" or \"by\" got \"%s\"\n",
 439                             fname, lineno, argv[i] );
 440                         acl_usage();
 441                 }
 442         }
 443
 444         /* if we have no real access clause, complain and do nothing */
 445         if ( a == NULL ) {
 446                         fprintf( stderr,
 447                                 "%s: line %d: warning: no access clause(s) specified in access line\n",
 448                             fname, lineno );
 449
 450         } else {
 451
 452 #ifdef LDAP_DEBUG
 453                 if (ldap_debug & LDAP_DEBUG_ACL)
 454                     print_acl(be, a);
 455 #endif
 456
 457                 if ( a->acl_access == NULL ) {
 458                         fprintf( stderr,
 459                         "%s: line %d: warning: no by clause(s) specified in access line\n",
 460                             fname, lineno );
 461                 }
 462
 463                 if ( be != NULL ) {
 464                         acl_append( &be->be_acl, a );
 465                 } else {
 466                         acl_append( &global_acl, a );
 467                 }
 468         }
 469 }
 470
 471 char *
 472 accessmask2str( slap_access_mask_t mask, char *buf )
 473 {
 474         int none=1;
 475
 476         assert( buf != NULL );
 477
 478         if ( ACL_IS_INVALID( mask ) ) {
 479                 return "invalid";
 480         }
 481
 482         buf[0] = '\0';
 483
 484         if ( ACL_IS_LEVEL( mask ) ) {
 485                 if ( ACL_LVL_IS_NONE(mask) ) {
 486                         strcat( buf, "none" );
 487
 488                 } else if ( ACL_LVL_IS_AUTH(mask) ) {
 489                         strcat( buf, "auth" );
 490
 491                 } else if ( ACL_LVL_IS_COMPARE(mask) ) {
 492                         strcat( buf, "compare" );
 493
 494                 } else if ( ACL_LVL_IS_SEARCH(mask) ) {
 495                         strcat( buf, "search" );
 496
 497                 } else if ( ACL_LVL_IS_READ(mask) ) {
 498                         strcat( buf, "read" );
 499
 500                 } else if ( ACL_LVL_IS_WRITE(mask) ) {
 501                         strcat( buf, "write" );
 502                 } else {
 503                         strcat( buf, "unknown" );
 504                 }
 505
 506                 strcat(buf, " (");
 507         }
 508
 509         if( ACL_IS_ADDITIVE( mask ) ) {
 510                 strcat( buf, "+" );
 511
 512         } else if( ACL_IS_SUBTRACTIVE( mask ) ) {
 513                 strcat( buf, "-" );
 514
 515         } else {
 516                 strcat( buf, "=" );
 517         }
 518
 519         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_WRITE) ) {
 520                 none = 0;
 521                 strcat( buf, "w" );
 522         }
 523
 524         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_READ) ) {
 525                 none = 0;
 526                 strcat( buf, "r" );
 527         }
 528
 529         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_SEARCH) ) {
 530                 none = 0;
 531                 strcat( buf, "s" );
 532         }
 533
 534         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_COMPARE) ) {
 535                 none = 0;
 536                 strcat( buf, "c" );
 537         }
 538
 539         if ( ACL_PRIV_ISSET(mask, ACL_PRIV_AUTH) ) {
 540                 none = 0;
 541                 strcat( buf, "x" );
 542         }
 543
 544         if ( none && ACL_PRIV_ISSET(mask, ACL_PRIV_NONE) ) {
 545                 none = 0;
 546                 strcat( buf, "n" );
 547         }
 548
 549         if ( none ) {
 550                 strcat( buf, "0" );
 551         }
 552
 553         if ( ACL_IS_LEVEL( mask ) ) {
 554                 strcat(buf, ")");
 555         }
 556         return buf;
 557 }
 558
 559 slap_access_mask_t
 560 str2accessmask( const char *str )
 561 {
 562         slap_access_mask_t      mask;
 563
 564         if( !isalpha(str[0]) ) {
 565                 int i;
 566
 567                 if ( str[0] == '=' ) {
 568                         ACL_INIT(mask);
 569
 570                 } else if( str[0] == '+' ) {
 571                         ACL_PRIV_ASSIGN(mask, ACL_PRIV_ADDITIVE);
 572
 573                 } else if( str[0] == '-' ) {
 574                         ACL_PRIV_ASSIGN(mask, ACL_PRIV_SUBSTRACTIVE);
 575
 576                 } else {
 577                         ACL_INVALIDATE(mask);
 578                         return mask;
 579                 }
 580
 581                 for( i=1; str[i] != '\0'; i++ ) {
 582                         if( TOLOWER(str[i]) == 'w' ) {
 583                                 ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
 584
 585                         } else if( TOLOWER(str[i]) == 'r' ) {
 586                                 ACL_PRIV_SET(mask, ACL_PRIV_READ);
 587
 588                         } else if( TOLOWER(str[i]) == 's' ) {
 589                                 ACL_PRIV_SET(mask, ACL_PRIV_SEARCH);
 590
 591                         } else if( TOLOWER(str[i]) == 'c' ) {
 592                                 ACL_PRIV_SET(mask, ACL_PRIV_COMPARE);
 593
 594                         } else if( TOLOWER(str[i]) == 'x' ) {
 595                                 ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
 596
 597                         } else if( str[i] != '0' ) {
 598                                 ACL_INVALIDATE(mask);
 599                                 return mask;
 600                         }
 601                 }
 602
 603                 return mask;
 604         }
 605
 606         if ( strcasecmp( str, "none" ) == 0 ) {
 607                 ACL_LVL_ASSIGN_NONE(mask);
 608
 609         } else if ( strcasecmp( str, "auth" ) == 0 ) {
 610                 ACL_LVL_ASSIGN_AUTH(mask);
 611
 612         } else if ( strcasecmp( str, "compare" ) == 0 ) {
 613                 ACL_LVL_ASSIGN_COMPARE(mask);
 614
 615         } else if ( strcasecmp( str, "search" ) == 0 ) {
 616                 ACL_LVL_ASSIGN_SEARCH(mask);
 617
 618         } else if ( strcasecmp( str, "read" ) == 0 ) {
 619                 ACL_LVL_ASSIGN_READ(mask);
 620
 621         } else if ( strcasecmp( str, "write" ) == 0 ) {
 622                 ACL_LVL_ASSIGN_WRITE(mask);
 623
 624         } else {
 625                 ACL_INVALIDATE( mask );
 626         }
 627
 628         return mask;
 629 }
 630
 631 static void
 632 acl_usage( void )
 633 {
 634         fprintf( stderr, "\n"
 635                 "<access clause> ::= access to <what> "
 636                                 "[ by <who> <access> <control> ]+ \n"
 637                 "<what> ::= * | [dn=<regex>] [filter=<ldapfilter>] [attrs=<attrlist>]\n"
 638                 "<attrlist> ::= <attr> | <attr> , <attrlist>\n"
 639                 "<attr> ::= <attrname> | entry | children\n"
 640                 "<who> ::= [ * | anonymous | self | dn=<regex> ]\n"
 641                         "\t[dnattr=<attrname>]\n"
 642                         "\t[group[/<objectclass>[/<attrname>]]=<regex>]\n"
 643                         "\t[peername=<regex>] [sockname=<regex>]\n"
 644                         "\t[domain=<regex>] [sockurl=<regex>]\n"
 645 #ifdef SLAPD_ACI_ENABLED
 646                         "\t[aci=<attrname>]\n"
 647 #endif
 648                 "<access> ::= [self]{<level>|<priv>}\n"
 649                 "<level> ::= none | auth | compare | search | read | write\n"
 650                 "<priv> ::= {=|+|-}{w|r|s|c|x}+\n"
 651                 "<control> ::= [ stop | continue | break ]\n"
 652                 );
 653         exit( EXIT_FAILURE );
 654 }
 655
 656 static void
 657 split(
 658     char        *line,
 659     int         splitchar,
 660     char        **left,
 661     char        **right
 662 )
 663 {
 664         *left = line;
 665         if ( (*right = strchr( line, splitchar )) != NULL ) {
 666                 *((*right)++) = '\0';
 667         }
 668 }
 669
 670 static void
 671 access_append( Access **l, Access *a )
 672 {
 673         for ( ; *l != NULL; l = &(*l)->a_next )
 674                 ;       /* NULL */
 675
 676         *l = a;
 677 }
 678
 679 void
 680 acl_append( AccessControl **l, AccessControl *a )
 681 {
 682         for ( ; *l != NULL; l = &(*l)->acl_next )
 683                 ;       /* NULL */
 684
 685         *l = a;
 686 }
 687
 688 #ifdef LDAP_DEBUG
 689
 690 static void
 691 print_access( Access *b )
 692 {
 693         char maskbuf[ACCESSMASK_MAXLEN];
 694
 695         fprintf( stderr, "\tby" );
 696
 697         if ( b->a_dn_pat != NULL ) {
 698                 if( strcmp(b->a_dn_pat, "anonymous") == 0 ) {
 699                         fprintf( stderr, " anonymous" );
 700
 701                 } else if( strcmp(b->a_dn_pat, "self") == 0 ) {
 702                         fprintf( stderr, " self" );
 703
 704                 } else {
 705                         fprintf( stderr, " dn=%s", b->a_dn_pat );
 706                 }
 707         }
 708
 709         if ( b->a_dn_at != NULL ) {
 710                 fprintf( stderr, " dnattr=%s", b->a_dn_at );
 711         }
 712
 713         if ( b->a_group_pat != NULL ) {
 714                 fprintf( stderr, " group: %s", b->a_group_pat );
 715
 716                 if ( b->a_group_oc ) {
 717                         fprintf( stderr, " objectClass: %s", b->a_group_oc );
 718
 719                         if ( b->a_group_at ) {
 720                                 fprintf( stderr, " attributeType: %s", b->a_group_at );
 721                         }
 722                 }
 723     }
 724
 725         if ( b->a_peername_pat != NULL ) {
 726                 fprintf( stderr, " peername=%s", b->a_peername_pat );
 727         }
 728
 729         if ( b->a_sockname_pat != NULL ) {
 730                 fprintf( stderr, " sockname=%s", b->a_sockname_pat );
 731         }
 732
 733         if ( b->a_domain_pat != NULL ) {
 734                 fprintf( stderr, " domain=%s", b->a_domain_pat );
 735         }
 736
 737         if ( b->a_sockurl_pat != NULL ) {
 738                 fprintf( stderr, " sockurl=%s", b->a_sockurl_pat );
 739         }
 740
 741 #ifdef SLAPD_ACI_ENABLED
 742         if ( b->a_aci_at != NULL ) {
 743                 fprintf( stderr, " aci=%s", b->a_aci_at );
 744         }
 745 #endif
 746
 747         fprintf( stderr, " %s%s",
 748                 b->a_dn_self ? "self" : "",
 749                 accessmask2str( b->a_mask, maskbuf ) );
 750
 751         if( b->a_type == ACL_BREAK ) {
 752                 fprintf( stderr, " break" );
 753
 754         } else if( b->a_type == ACL_CONTINUE ) {
 755                 fprintf( stderr, " continue" );
 756
 757         } else if( b->a_type != ACL_STOP ) {
 758                 fprintf( stderr, " unknown-control" );
 759         }
 760
 761         fprintf( stderr, "\n" );
 762 }
 763
 764 char *
 765 access2str( slap_access_t access )
 766 {
 767         if ( access == ACL_NONE ) {
 768                 return "none";
 769
 770         } else if ( access == ACL_AUTH ) {
 771                 return "auth";
 772
 773         } else if ( access == ACL_COMPARE ) {
 774                 return "compare";
 775
 776         } else if ( access == ACL_SEARCH ) {
 777                 return "search";
 778
 779         } else if ( access == ACL_READ ) {
 780                 return "read";
 781
 782         } else if ( access == ACL_WRITE ) {
 783                 return "write";
 784         }
 785
 786         return "unknown";
 787 }
 788
 789 slap_access_t
 790 str2access( const char *str )
 791 {
 792         if ( strcasecmp( str, "none" ) == 0 ) {
 793                 return ACL_NONE;
 794
 795         } else if ( strcasecmp( str, "auth" ) == 0 ) {
 796                 return ACL_AUTH;
 797
 798         } else if ( strcasecmp( str, "compare" ) == 0 ) {
 799                 return ACL_COMPARE;
 800
 801         } else if ( strcasecmp( str, "search" ) == 0 ) {
 802                 return ACL_SEARCH;
 803
 804         } else if ( strcasecmp( str, "read" ) == 0 ) {
 805                 return ACL_READ;
 806
 807         } else if ( strcasecmp( str, "write" ) == 0 ) {
 808                 return ACL_WRITE;
 809         }
 810
 811         return( ACL_INVALID_ACCESS );
 812 }
 813
 814
 815 static void
 816 print_acl( Backend *be, AccessControl *a )
 817 {
 818         int             to = 0;
 819         Access  *b;
 820
 821         fprintf( stderr, "%s ACL: access to",
 822                 be == NULL ? "Global" : "Backend" );
 823
 824         if ( a->acl_dn_pat != NULL ) {
 825                 to++;
 826                 fprintf( stderr, " dn=%s\n",
 827                         a->acl_dn_pat );
 828         }
 829
 830         if ( a->acl_filter != NULL ) {
 831                 to++;
 832                 fprintf( stderr, " filter=" );
 833                 filter_print( a->acl_filter );
 834                 fprintf( stderr, "\n" );
 835         }
 836
 837         if ( a->acl_attrs != NULL ) {
 838                 int     i, first = 1;
 839                 to++;
 840
 841                 fprintf( stderr, " attrs=" );
 842                 for ( i = 0; a->acl_attrs[i] != NULL; i++ ) {
 843                         if ( ! first ) {
 844                                 fprintf( stderr, "," );
 845                         }
 846                         fprintf( stderr, a->acl_attrs[i] );
 847                         first = 0;
 848                 }
 849                 fprintf(  stderr, "\n" );
 850         }
 851
 852         if( !to ) {
 853                 fprintf( stderr, " *\n" );
 854         }
 855
 856         for ( b = a->acl_access; b != NULL; b = b->a_next ) {
 857                 print_access( b );
 858         }
 859
 860         fprintf( stderr, "\n" );
 861 }
 862
 863 #endif /* LDAP_DEBUG */