git.sur5r.net Git - openldap/blob - servers/slapd/slapacl.c

   1 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   2  *
   3  * Copyright 2004-2005 The OpenLDAP Foundation.
   4  * Portions Copyright 2004 Pierangelo Masarati.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15 /* ACKNOWLEDGEMENTS:
  16  * This work was initially developed by Pierangelo Masarati for inclusion
  17  * in OpenLDAP Software.
  18  */
  19
  20 #include "portable.h"
  21
  22 #include <stdio.h>
  23
  24 #include <ac/stdlib.h>
  25
  26 #include <ac/ctype.h>
  27 #include <ac/string.h>
  28 #include <ac/socket.h>
  29 #include <ac/unistd.h>
  30
  31 #include <lber.h>
  32 #include <ldif.h>
  33 #include <lutil.h>
  34
  35 #include "slapcommon.h"
  36
  37 static int
  38 print_access(
  39         Operation               *op,
  40         Entry                   *e,
  41         AttributeDescription    *desc,
  42         struct berval           *val,
  43         struct berval           *nval )
  44 {
  45         int                     rc;
  46         slap_mask_t             mask;
  47         char                    accessmaskbuf[ACCESSMASK_MAXLEN];
  48         slap_access_t           access = ACL_AUTH;
  49
  50         rc = access_allowed_mask( op, e, desc, nval, ACL_AUTH, NULL, &mask );
  51
  52         fprintf( stderr, "%s%s%s: %s\n",
  53                         desc->ad_cname.bv_val,
  54                         ( val && !BER_BVISNULL( val ) ) ? "=" : "",
  55                         ( val && !BER_BVISNULL( val ) ) ?
  56                                 ( desc == slap_schema.si_ad_userPassword ? "****" : val->bv_val ) : "",
  57                         accessmask2str( mask, accessmaskbuf, 1 ) );
  58
  59         return rc;
  60 }
  61
  62 int
  63 slapacl( int argc, char **argv )
  64 {
  65         int                     rc = EXIT_SUCCESS;
  66         const char              *progname = "slapacl";
  67         Connection              conn = { 0 };
  68         Listener                listener;
  69         char                    opbuf[OPERATION_BUFFER_SIZE];
  70         Operation               *op;
  71         Entry                   e = { 0 }, *ep = &e;
  72         char                    *attr = NULL;
  73
  74         slap_tool_init( progname, SLAPACL, argc, argv );
  75
  76         argv = &argv[ optind ];
  77         argc -= optind;
  78
  79         op = (Operation *)opbuf;
  80         connection_fake_init( &conn, op, &conn );
  81
  82         conn.c_listener = &listener;
  83         conn.c_listener_url = listener_url;
  84         conn.c_peer_domain = peer_domain;
  85         conn.c_peer_name = peer_name;
  86         conn.c_sock_name = sock_name;
  87         op->o_ssf = ssf;
  88         op->o_transport_ssf = transport_ssf;
  89         op->o_tls_ssf = tls_ssf;
  90         op->o_sasl_ssf = sasl_ssf;
  91
  92         if ( !BER_BVISNULL( &authcID ) ) {
  93                 if ( !BER_BVISNULL( &authcDN ) ) {
  94                         fprintf( stderr, "both authcID=\"%s\" "
  95                                         "and authcDN=\"%s\" provided\n",
  96                                         authcID.bv_val, authcDN.bv_val );
  97                         rc = 1;
  98                         goto destroy;
  99                 }
 100
 101                 rc = slap_sasl_getdn( &conn, op, &authcID, NULL,
 102                                 &authcDN, SLAP_GETDN_AUTHCID );
 103                 if ( rc != LDAP_SUCCESS ) {
 104                         fprintf( stderr, "authcID: <%s> check failed %d (%s)\n",
 105                                         authcID.bv_val, rc,
 106                                         ldap_err2string( rc ) );
 107                         rc = 1;
 108                         goto destroy;
 109                 }
 110
 111         } else if ( !BER_BVISNULL( &authcDN ) ) {
 112                 struct berval   ndn;
 113
 114                 rc = dnNormalize( 0, NULL, NULL, &authcDN, &ndn, NULL );
 115                 if ( rc != LDAP_SUCCESS ) {
 116                         fprintf( stderr, "autchDN=\"%s\" normalization failed %d (%s)\n",
 117                                         authcDN.bv_val, rc,
 118                                         ldap_err2string( rc ) );
 119                         rc = 1;
 120                         goto destroy;
 121                 }
 122                 ch_free( authcDN.bv_val );
 123                 authcDN = ndn;
 124         }
 125
 126         if ( !BER_BVISNULL( &authzID ) ) {
 127                 if ( !BER_BVISNULL( &authzDN ) ) {
 128                         fprintf( stderr, "both authzID=\"%s\" "
 129                                         "and authzDN=\"%s\" provided\n",
 130                                         authzID.bv_val, authzDN.bv_val );
 131                         rc = 1;
 132                         goto destroy;
 133                 }
 134
 135                 rc = slap_sasl_getdn( &conn, op, &authzID, NULL,
 136                                 &authzDN, SLAP_GETDN_AUTHZID );
 137                 if ( rc != LDAP_SUCCESS ) {
 138                         fprintf( stderr, "authzID: <%s> check failed %d (%s)\n",
 139                                         authzID.bv_val, rc,
 140                                         ldap_err2string( rc ) );
 141                         rc = 1;
 142                         goto destroy;
 143                 }
 144
 145         } else if ( !BER_BVISNULL( &authzDN ) ) {
 146                 struct berval   ndn;
 147
 148                 rc = dnNormalize( 0, NULL, NULL, &authzDN, &ndn, NULL );
 149                 if ( rc != LDAP_SUCCESS ) {
 150                         fprintf( stderr, "autchDN=\"%s\" normalization failed %d (%s)\n",
 151                                         authzDN.bv_val, rc,
 152                                         ldap_err2string( rc ) );
 153                         rc = 1;
 154                         goto destroy;
 155                 }
 156                 ch_free( authzDN.bv_val );
 157                 authzDN = ndn;
 158         }
 159
 160
 161         if ( !BER_BVISNULL( &authcDN ) ) {
 162                 fprintf( stderr, "authcDN: \"%s\"\n", authcDN.bv_val );
 163         }
 164
 165         if ( !BER_BVISNULL( &authzDN ) ) {
 166                 fprintf( stderr, "authzDN: \"%s\"\n", authzDN.bv_val );
 167         }
 168
 169         assert( !BER_BVISNULL( &baseDN ) );
 170         rc = dnPrettyNormal( NULL, &baseDN, &e.e_name, &e.e_nname, NULL );
 171         if ( rc != LDAP_SUCCESS ) {
 172                 fprintf( stderr, "base=\"%s\" normalization failed %d (%s)\n",
 173                                 baseDN.bv_val, rc,
 174                                 ldap_err2string( rc ) );
 175                 rc = 1;
 176                 goto destroy;
 177         }
 178
 179         op->o_bd = be;
 180         if ( !BER_BVISNULL( &authzDN ) ) {
 181                 op->o_dn = authzDN;
 182                 op->o_ndn = authzDN;
 183         }
 184         if ( !BER_BVISNULL( &authcDN ) ) {
 185                 op->o_conn->c_dn = authcDN;
 186                 op->o_conn->c_ndn = authcDN;
 187         }
 188
 189         if ( !dryrun && be ) {
 190                 ID      id;
 191
 192                 if ( !be->be_entry_open ||
 193                         !be->be_entry_close ||
 194                         !be->be_dn2id_get ||
 195                         !be->be_entry_get )
 196                 {
 197                         fprintf( stderr, "%s: target database "
 198                                 "doesn't support necessary operations; "
 199                                 "you may try with \"-u\" (dry run).\n",
 200                                 progname );
 201                         rc = 1;
 202                         goto destroy;
 203                 }
 204
 205                 if ( be->be_entry_open( be, 0 ) != 0 ) {
 206                         fprintf( stderr, "%s: could not open database.\n",
 207                                 progname );
 208                         rc = 1;
 209                         goto destroy;
 210                 }
 211
 212                 id = be->be_dn2id_get( be, &e.e_nname );
 213                 if ( id == NOID ) {
 214                         fprintf( stderr, "%s: unable to fetch ID of DN \"%s\"\n",
 215                                 progname, e.e_nname.bv_val );
 216                         rc = 1;
 217                         goto destroy;
 218                 }
 219                 if ( be->be_id2entry_get( be, id, &ep ) != 0 ) {
 220                         fprintf( stderr, "%s: unable to fetch entry \"%s\" (%lu)\n",
 221                                 progname, e.e_nname.bv_val, id );
 222                         rc = 1;
 223                         goto destroy;
 224
 225                 }
 226
 227                 if ( argc == 0 ) {
 228                         Attribute       *a;
 229
 230                         (void)print_access( op, ep, slap_schema.si_ad_entry, NULL, NULL );
 231                         (void)print_access( op, ep, slap_schema.si_ad_children, NULL, NULL );
 232
 233                         for ( a = ep->e_attrs; a; a = a->a_next ) {
 234                                 int     i;
 235
 236                                 for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
 237                                         (void)print_access( op, ep, a->a_desc,
 238                                                         &a->a_vals[ i ],
 239                                                         &a->a_nvals[ i ] );
 240                                 }
 241                         }
 242                 }
 243         }
 244
 245         for ( ; argc--; argv++ ) {
 246                 slap_mask_t             mask;
 247                 AttributeDescription    *desc = NULL;
 248                 struct berval           val = BER_BVNULL,
 249                                         *valp = NULL;
 250                 const char              *text;
 251                 char                    accessmaskbuf[ACCESSMASK_MAXLEN];
 252                 char                    *accessstr;
 253                 slap_access_t           access = ACL_AUTH;
 254
 255                 if ( attr == NULL ) {
 256                         attr = argv[ 0 ];
 257                 }
 258
 259                 val.bv_val = strchr( attr, ':' );
 260                 if ( val.bv_val != NULL ) {
 261                         val.bv_val[0] = '\0';
 262                         val.bv_val++;
 263                         val.bv_len = strlen( val.bv_val );
 264                         valp = &val;
 265                 }
 266
 267                 accessstr = strchr( attr, '/' );
 268                 if ( accessstr != NULL ) {
 269                         accessstr[0] = '\0';
 270                         accessstr++;
 271                         access = str2access( accessstr );
 272                         if ( access == ACL_INVALID_ACCESS ) {
 273                                 fprintf( stderr, "unknown access \"%s\" for attribute \"%s\"\n",
 274                                                 accessstr, attr );
 275                                 if ( continuemode ) {
 276                                         continue;
 277                                 }
 278                                 break;
 279                         }
 280                 }
 281
 282                 rc = slap_str2ad( attr, &desc, &text );
 283                 if ( rc != LDAP_SUCCESS ) {
 284                         fprintf( stderr, "slap_str2ad(%s) failed %d (%s)\n",
 285                                         attr, rc, ldap_err2string( rc ) );
 286                         if ( continuemode ) {
 287                                 continue;
 288                         }
 289                         break;
 290                 }
 291
 292                 rc = access_allowed_mask( op, ep, desc, valp, access,
 293                                 NULL, &mask );
 294
 295                 if ( accessstr ) {
 296                         fprintf( stderr, "%s access to %s%s%s: %s\n",
 297                                         accessstr,
 298                                         desc->ad_cname.bv_val,
 299                                         val.bv_val ? "=" : "",
 300                                         val.bv_val ? val.bv_val : "",
 301                                         rc ? "ALLOWED" : "DENIED" );
 302
 303                 } else {
 304                         fprintf( stderr, "%s%s%s: %s\n",
 305                                         desc->ad_cname.bv_val,
 306                                         val.bv_val ? "=" : "",
 307                                         val.bv_val ? val.bv_val : "",
 308                                         accessmask2str( mask, accessmaskbuf, 1 ) );
 309                 }
 310                 rc = 0;
 311                 attr = NULL;
 312         }
 313
 314 destroy:;
 315         ber_memfree( e.e_name.bv_val );
 316         ber_memfree( e.e_nname.bv_val );
 317         if ( !dryrun && be ) {
 318                 if ( ep != &e ) {
 319                         be_entry_release_r( op, ep );
 320                 }
 321                 be->be_entry_close( be );
 322         }
 323
 324         slap_tool_destroy();
 325
 326         return rc;
 327 }
 328