Fix passwd clearing bug

[openldap] / servers / slapd / acl.c

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index b61b1570c18a92b00aa0f69570d213fcfc134606..7b5d30bff6dbeab941499291d6a038abff3e9232 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -24,7 +24,7 @@ static AccessControl * acl_get(
        int nmatches, regmatch_t *matches );
 
 static slap_control_t acl_mask(
-       AccessControl *ac, slap_access_mask_t *mask,
+       AccessControl *ac, slap_mask_t *mask,
        Backend *be, Connection *conn, Operation *op,
        Entry *e,
        AttributeDescription *desc,
@@ -85,7 +85,7 @@ access_allowed(
 #ifdef LDAP_DEBUG
        char accessmaskbuf[ACCESSMASK_MAXLEN];
 #endif
-       slap_access_mask_t mask;
+       slap_mask_t mask;
        slap_control_t control;
 
        const char *attr = desc ? desc->ad_cname->bv_val : NULL;
@@ -115,7 +115,9 @@ access_allowed(
         * by ACL_WRITE checking as any found here are not provided
         * by the user
         */
-       if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type ) )
+       if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
+               && desc != slap_schema.si_ad_entry
+               && desc != slap_schema.si_ad_children )
        {
                Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
                        " %s access granted\n",
@@ -152,7 +154,7 @@ access_allowed(
        a = NULL;
        count = 0;
 
-       while( a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches ) )
+       while((a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches )) != NULL)
        {
                int i;
 
@@ -339,7 +341,7 @@ acl_get(
 static slap_control_t
 acl_mask(
     AccessControl      *a,
-       slap_access_mask_t *mask,
+       slap_mask_t *mask,
     Backend            *be,
     Connection *conn,
     Operation  *op,
@@ -364,13 +366,13 @@ acl_mask(
                e->e_dn, attr, 0 );
 
        Debug( LDAP_DEBUG_ACL,
-               "=> acl_mask: to value \"%s\" by \"%s\", (%s) \n",
-               val ? val->bv_val : "*",
+               "=> acl_mask: to %s by \"%s\", (%s) \n",
+               val ? "value" : "all values",
                op->o_ndn ?  op->o_ndn : "",
                accessmask2str( *mask, accessmaskbuf ) );
 
        for ( i = 1, b = a->acl_access; b != NULL; b = b->a_next, i++ ) {
-               slap_access_mask_t oldmask, modmask;
+               slap_mask_t oldmask, modmask;
 
                ACL_INVALIDATE( modmask );
 
@@ -617,7 +619,7 @@ acl_mask(
                                buf[sizeof(buf) - 1] = 0;
                        }
 
-                       if (backend_group(be, e, buf, op->o_ndn,
+                       if (backend_group(be, conn, op, e, buf, op->o_ndn,
                                b->a_group_oc, b->a_group_at) != 0)
                        {
                                continue;
@@ -634,6 +636,45 @@ acl_mask(
                        }
                }
 
+               if ( b->a_authz.sai_ssf ) {
+                       Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_ssf, op->o_ssf, 0 );
+
+                       if ( b->a_authz.sai_ssf >  op->o_ssf ) {
+                               continue;
+                       }
+               }
+
+               if ( b->a_authz.sai_transport_ssf ) {
+                       Debug( LDAP_DEBUG_ACL,
+                               "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
+
+                       if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
+                               continue;
+                       }
+               }
+
+               if ( b->a_authz.sai_tls_ssf ) {
+                       Debug( LDAP_DEBUG_ACL,
+                               "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
+
+                       if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
+                               continue;
+                       }
+               }
+
+               if ( b->a_authz.sai_sasl_ssf ) {
+                       Debug( LDAP_DEBUG_ACL,
+                               "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
+
+                       if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
+                               continue;
+                       }
+               }
+
 #ifdef SLAPD_ACI_ENABLED
                if ( b->a_aci_at != NULL ) {
                        Attribute       *at;
@@ -641,7 +682,7 @@ acl_mask(
 
                        /* this case works different from the others above.
                         * since aci's themselves give permissions, we need
-                        * to first check b->a_mask, the ACL's access level.
+                        * to first check b->a_access_mask, the ACL's access level.
                         */
 
                        if( op->o_ndn == NULL || op->o_ndn[0] == '\0' ) {
@@ -655,7 +696,7 @@ acl_mask(
                        /* first check if the right being requested
                         * is allowed by the ACL clause.
                         */
-                       if ( ! ACL_GRANT( b->a_mask, *mask ) ) {
+                       if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) {
                                continue;
                        }
 
@@ -684,7 +725,7 @@ acl_mask(
                        }
 
                        /* remove anything that the ACL clause does not allow */
-                       tgrant &= b->a_mask & ACL_PRIV_MASK;
+                       tgrant &= b->a_access_mask & ACL_PRIV_MASK;
                        tdeny &= ACL_PRIV_MASK;
 
                        /* see if we have anything to contribute */
@@ -713,7 +754,7 @@ acl_mask(
                } else
 #endif
                {
-                       modmask = b->a_mask;
+                       modmask = b->a_access_mask;
                }
 
 
@@ -877,7 +918,7 @@ aci_bvstrdup( struct berval *bv )
 
        s = (char *)ch_malloc(bv->bv_len + 1);
        if (s != NULL) {
-               memcpy(s, bv->bv_val, bv->bv_len);
+               AC_MEMCPY(s, bv->bv_val, bv->bv_len);
                s[bv->bv_len] = 0;
        }
        return(s);
@@ -1221,6 +1262,7 @@ aci_group_member (
        const char *defgrpat,
     Backend            *be,
     Entry              *e,
+    Connection         *conn,
     Operation          *op,
        regmatch_t      *matches
 )
@@ -1269,7 +1311,7 @@ aci_group_member (
        if (grp_oc != NULL && grp_ad != NULL && grpdn != NULL) {
                string_expand(grpdn, 1024, subjdn, e->e_ndn, matches);
                if ( dn_normalize(grpdn) != NULL ) {
-                       rc = (backend_group(be, e, grpdn, op->o_ndn, grp_oc, grp_ad) == 0);
+                       rc = (backend_group(be, conn, op, e, grpdn, op->o_ndn, grp_oc, grp_ad) == 0);
                }
        }
 
@@ -1389,11 +1431,11 @@ aci_mask(
 
 
        } else if (aci_strbvcmp( "group", &bv ) == 0) {
-               if (aci_group_member(&sdn, SLAPD_GROUP_CLASS, SLAPD_GROUP_ATTR, be, e, op, matches))
+               if (aci_group_member(&sdn, SLAPD_GROUP_CLASS, SLAPD_GROUP_ATTR, be, e, conn, op, matches))
                        return(1);
 
        } else if (aci_strbvcmp( "role", &bv ) == 0) {
-               if (aci_group_member(&sdn, SLAPD_ROLE_CLASS, SLAPD_ROLE_ATTR, be, e, op, matches))
+               if (aci_group_member(&sdn, SLAPD_ROLE_CLASS, SLAPD_ROLE_ATTR, be, e, conn, op, matches))
                        return(1);
 
        } else if (aci_strbvcmp( "set", &bv ) == 0) {