git.sur5r.net Git - openldap/blob - servers/slapd/slapacl.c

   1 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
   2  *
   3  * Copyright 2004-2005 The OpenLDAP Foundation.
   4  * Portions Copyright 2004 Pierangelo Masarati.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted only as authorized by the OpenLDAP
   9  * Public License.
  10  *
  11  * A copy of this license is available in file LICENSE in the
  12  * top-level directory of the distribution or, alternatively, at
  13  * <http://www.OpenLDAP.org/license.html>.
  14  */
  15 /* ACKNOWLEDGEMENTS:
  16  * This work was initially developed by Pierangelo Masarati for inclusion
  17  * in OpenLDAP Software.
  18  */
  19
  20 #include "portable.h"
  21
  22 #include <stdio.h>
  23
  24 #include <ac/stdlib.h>
  25
  26 #include <ac/ctype.h>
  27 #include <ac/string.h>
  28 #include <ac/socket.h>
  29 #include <ac/unistd.h>
  30
  31 #include <lber.h>
  32 #include <ldif.h>
  33 #include <lutil.h>
  34
  35 #include "slapcommon.h"
  36
  37 static int
  38 print_access(
  39         Operation               *op,
  40         Entry                   *e,
  41         AttributeDescription    *desc,
  42         struct berval           *val,
  43         struct berval           *nval )
  44 {
  45         int                     rc;
  46         slap_mask_t             mask;
  47         char                    accessmaskbuf[ACCESSMASK_MAXLEN];
  48
  49         rc = access_allowed_mask( op, e, desc, nval, ACL_AUTH, NULL, &mask );
  50
  51         fprintf( stderr, "%s%s%s: %s\n",
  52                         desc->ad_cname.bv_val,
  53                         ( val && !BER_BVISNULL( val ) ) ? "=" : "",
  54                         ( val && !BER_BVISNULL( val ) ) ?
  55                                 ( desc == slap_schema.si_ad_userPassword ? "****" : val->bv_val ) : "",
  56                         accessmask2str( mask, accessmaskbuf, 1 ) );
  57
  58         return rc;
  59 }
  60
  61 int
  62 slapacl( int argc, char **argv )
  63 {
  64         int                     rc = EXIT_SUCCESS;
  65         const char              *progname = "slapacl";
  66         Connection              conn = { 0 };
  67         Listener                listener;
  68         char                    opbuf[OPERATION_BUFFER_SIZE];
  69         Operation               *op;
  70         Entry                   e = { 0 }, *ep = &e;
  71         char                    *attr = NULL;
  72         int                     doclose = 0;
  73         BackendDB               *bd;
  74
  75         slap_tool_init( progname, SLAPACL, argc, argv );
  76
  77         if ( !dryrun ) {
  78                 int     i = 0;
  79
  80                 LDAP_STAILQ_FOREACH( bd, &backendDB, be_next ) {
  81                         if ( bd != be && backend_startup( bd ) ) {
  82                                 fprintf( stderr, "backend_startup(#%d%s%s) failed\n",
  83                                                 i,
  84                                                 bd->be_suffix ? ": " : "",
  85                                                 bd->be_suffix ? bd->be_suffix[0].bv_val : "" );
  86                                 rc = 1;
  87                                 goto destroy;
  88                         }
  89                 }
  90         }
  91
  92         argv = &argv[ optind ];
  93         argc -= optind;
  94
  95         op = (Operation *)opbuf;
  96         connection_fake_init( &conn, op, &conn );
  97
  98         conn.c_listener = &listener;
  99         conn.c_listener_url = listener_url;
 100         conn.c_peer_domain = peer_domain;
 101         conn.c_peer_name = peer_name;
 102         conn.c_sock_name = sock_name;
 103         op->o_ssf = ssf;
 104         op->o_transport_ssf = transport_ssf;
 105         op->o_tls_ssf = tls_ssf;
 106         op->o_sasl_ssf = sasl_ssf;
 107
 108         if ( !BER_BVISNULL( &authcID ) ) {
 109                 if ( !BER_BVISNULL( &authcDN ) ) {
 110                         fprintf( stderr, "both authcID=\"%s\" "
 111                                         "and authcDN=\"%s\" provided\n",
 112                                         authcID.bv_val, authcDN.bv_val );
 113                         rc = 1;
 114                         goto destroy;
 115                 }
 116
 117                 rc = slap_sasl_getdn( &conn, op, &authcID, NULL,
 118                                 &authcDN, SLAP_GETDN_AUTHCID );
 119                 if ( rc != LDAP_SUCCESS ) {
 120                         fprintf( stderr, "authcID: <%s> check failed %d (%s)\n",
 121                                         authcID.bv_val, rc,
 122                                         ldap_err2string( rc ) );
 123                         rc = 1;
 124                         goto destroy;
 125                 }
 126
 127         } else if ( !BER_BVISNULL( &authcDN ) ) {
 128                 struct berval   ndn;
 129
 130                 rc = dnNormalize( 0, NULL, NULL, &authcDN, &ndn, NULL );
 131                 if ( rc != LDAP_SUCCESS ) {
 132                         fprintf( stderr, "autchDN=\"%s\" normalization failed %d (%s)\n",
 133                                         authcDN.bv_val, rc,
 134                                         ldap_err2string( rc ) );
 135                         rc = 1;
 136                         goto destroy;
 137                 }
 138                 ch_free( authcDN.bv_val );
 139                 authcDN = ndn;
 140         }
 141
 142         if ( !BER_BVISNULL( &authzID ) ) {
 143                 if ( !BER_BVISNULL( &authzDN ) ) {
 144                         fprintf( stderr, "both authzID=\"%s\" "
 145                                         "and authzDN=\"%s\" provided\n",
 146                                         authzID.bv_val, authzDN.bv_val );
 147                         rc = 1;
 148                         goto destroy;
 149                 }
 150
 151                 rc = slap_sasl_getdn( &conn, op, &authzID, NULL,
 152                                 &authzDN, SLAP_GETDN_AUTHZID );
 153                 if ( rc != LDAP_SUCCESS ) {
 154                         fprintf( stderr, "authzID: <%s> check failed %d (%s)\n",
 155                                         authzID.bv_val, rc,
 156                                         ldap_err2string( rc ) );
 157                         rc = 1;
 158                         goto destroy;
 159                 }
 160
 161         } else if ( !BER_BVISNULL( &authzDN ) ) {
 162                 struct berval   ndn;
 163
 164                 rc = dnNormalize( 0, NULL, NULL, &authzDN, &ndn, NULL );
 165                 if ( rc != LDAP_SUCCESS ) {
 166                         fprintf( stderr, "autchDN=\"%s\" normalization failed %d (%s)\n",
 167                                         authzDN.bv_val, rc,
 168                                         ldap_err2string( rc ) );
 169                         rc = 1;
 170                         goto destroy;
 171                 }
 172                 ch_free( authzDN.bv_val );
 173                 authzDN = ndn;
 174         }
 175
 176
 177         if ( !BER_BVISNULL( &authcDN ) ) {
 178                 fprintf( stderr, "authcDN: \"%s\"\n", authcDN.bv_val );
 179         }
 180
 181         if ( !BER_BVISNULL( &authzDN ) ) {
 182                 fprintf( stderr, "authzDN: \"%s\"\n", authzDN.bv_val );
 183         }
 184
 185         if ( !BER_BVISNULL( &authzDN ) ) {
 186                 op->o_dn = authzDN;
 187                 op->o_ndn = authzDN;
 188
 189                 if ( !BER_BVISNULL( &authcDN ) ) {
 190                         op->o_conn->c_dn = authcDN;
 191                         op->o_conn->c_ndn = authcDN;
 192
 193                 } else {
 194                         op->o_conn->c_dn = authzDN;
 195                         op->o_conn->c_ndn = authzDN;
 196                 }
 197
 198         } else if ( !BER_BVISNULL( &authcDN ) ) {
 199                 op->o_conn->c_dn = authcDN;
 200                 op->o_conn->c_ndn = authcDN;
 201                 op->o_dn = authcDN;
 202                 op->o_ndn = authcDN;
 203         }
 204
 205         assert( !BER_BVISNULL( &baseDN ) );
 206         rc = dnPrettyNormal( NULL, &baseDN, &e.e_name, &e.e_nname, NULL );
 207         if ( rc != LDAP_SUCCESS ) {
 208                 fprintf( stderr, "base=\"%s\" normalization failed %d (%s)\n",
 209                                 baseDN.bv_val, rc,
 210                                 ldap_err2string( rc ) );
 211                 rc = 1;
 212                 goto destroy;
 213         }
 214
 215         op->o_bd = be;
 216         if ( !dryrun && be ) {
 217                 ID      id;
 218
 219                 if ( !be->be_entry_open ||
 220                         !be->be_entry_close ||
 221                         !be->be_dn2id_get ||
 222                         !be->be_entry_get )
 223                 {
 224                         fprintf( stderr, "%s: target database "
 225                                 "doesn't support necessary operations; "
 226                                 "you may try with \"-u\" (dry run).\n",
 227                                 progname );
 228                         rc = 1;
 229                         goto destroy;
 230                 }
 231
 232                 if ( be->be_entry_open( be, 0 ) != 0 ) {
 233                         fprintf( stderr, "%s: could not open database.\n",
 234                                 progname );
 235                         rc = 1;
 236                         goto destroy;
 237                 }
 238
 239                 doclose = 1;
 240
 241                 id = be->be_dn2id_get( be, &e.e_nname );
 242                 if ( id == NOID ) {
 243                         fprintf( stderr, "%s: unable to fetch ID of DN \"%s\"\n",
 244                                 progname, e.e_nname.bv_val );
 245                         rc = 1;
 246                         goto destroy;
 247                 }
 248                 if ( be->be_id2entry_get( be, id, &ep ) != 0 ) {
 249                         fprintf( stderr, "%s: unable to fetch entry \"%s\" (%lu)\n",
 250                                 progname, e.e_nname.bv_val, id );
 251                         rc = 1;
 252                         goto destroy;
 253
 254                 }
 255
 256                 if ( argc == 0 ) {
 257                         Attribute       *a;
 258
 259                         (void)print_access( op, ep, slap_schema.si_ad_entry, NULL, NULL );
 260                         (void)print_access( op, ep, slap_schema.si_ad_children, NULL, NULL );
 261
 262                         for ( a = ep->e_attrs; a; a = a->a_next ) {
 263                                 int     i;
 264
 265                                 for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ ) {
 266                                         (void)print_access( op, ep, a->a_desc,
 267                                                         &a->a_vals[ i ],
 268                                                         &a->a_nvals[ i ] );
 269                                 }
 270                         }
 271                 }
 272         }
 273
 274         for ( ; argc--; argv++ ) {
 275                 slap_mask_t             mask;
 276                 AttributeDescription    *desc = NULL;
 277                 struct berval           val = BER_BVNULL,
 278                                         *valp = NULL;
 279                 const char              *text;
 280                 char                    accessmaskbuf[ACCESSMASK_MAXLEN];
 281                 char                    *accessstr;
 282                 slap_access_t           access = ACL_AUTH;
 283
 284                 if ( attr == NULL ) {
 285                         attr = argv[ 0 ];
 286                 }
 287
 288                 val.bv_val = strchr( attr, ':' );
 289                 if ( val.bv_val != NULL ) {
 290                         val.bv_val[0] = '\0';
 291                         val.bv_val++;
 292                         val.bv_len = strlen( val.bv_val );
 293                         valp = &val;
 294                 }
 295
 296                 accessstr = strchr( attr, '/' );
 297                 if ( accessstr != NULL ) {
 298                         accessstr[0] = '\0';
 299                         accessstr++;
 300                         access = str2access( accessstr );
 301                         if ( access == ACL_INVALID_ACCESS ) {
 302                                 fprintf( stderr, "unknown access \"%s\" for attribute \"%s\"\n",
 303                                                 accessstr, attr );
 304                                 if ( continuemode ) {
 305                                         continue;
 306                                 }
 307                                 break;
 308                         }
 309                 }
 310
 311                 rc = slap_str2ad( attr, &desc, &text );
 312                 if ( rc != LDAP_SUCCESS ) {
 313                         fprintf( stderr, "slap_str2ad(%s) failed %d (%s)\n",
 314                                         attr, rc, ldap_err2string( rc ) );
 315                         if ( continuemode ) {
 316                                 continue;
 317                         }
 318                         break;
 319                 }
 320
 321                 rc = access_allowed_mask( op, ep, desc, valp, access,
 322                                 NULL, &mask );
 323
 324                 if ( accessstr ) {
 325                         fprintf( stderr, "%s access to %s%s%s: %s\n",
 326                                         accessstr,
 327                                         desc->ad_cname.bv_val,
 328                                         val.bv_val ? "=" : "",
 329                                         val.bv_val ? val.bv_val : "",
 330                                         rc ? "ALLOWED" : "DENIED" );
 331
 332                 } else {
 333                         fprintf( stderr, "%s%s%s: %s\n",
 334                                         desc->ad_cname.bv_val,
 335                                         val.bv_val ? "=" : "",
 336                                         val.bv_val ? val.bv_val : "",
 337                                         accessmask2str( mask, accessmaskbuf, 1 ) );
 338                 }
 339                 rc = 0;
 340                 attr = NULL;
 341         }
 342
 343 destroy:;
 344         if ( !BER_BVISNULL( &e.e_name ) ) {
 345                 ber_memfree( e.e_name.bv_val );
 346         }
 347         if ( !BER_BVISNULL( &e.e_nname ) ) {
 348                 ber_memfree( e.e_nname.bv_val );
 349         }
 350         if ( !dryrun && be ) {
 351                 if ( ep != &e ) {
 352                         be_entry_release_r( op, ep );
 353                 }
 354                 if ( doclose ) {
 355                         be->be_entry_close( be );
 356                 }
 357
 358                 LDAP_STAILQ_FOREACH( bd, &backendDB, be_next ) {
 359                         if ( bd != be ) {
 360                                 backend_shutdown( bd );
 361                         }
 362                 }
 363         }
 364
 365         slap_tool_destroy();
 366
 367         return rc;
 368 }
 369