streamline group attr specification/diagnostics

[openldap] / servers / slapd / acl.c

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index b3fe310d45d09798acd29e1184320bd0c013f64d..f557f50fc8c2b3527b24e8a6799615d910ba3b51 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2006 The OpenLDAP Foundation.
+ * Copyright 1998-2007 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -40,6 +40,9 @@
 #define ACL_BUF_SIZE   1024    /* use most appropriate size */
 
 static const struct berval     acl_bv_ip_eq = BER_BVC( "IP=" );
+#ifdef LDAP_PF_INET6
+static const struct berval     acl_bv_ipv6_eq = BER_BVC( "IP=[" );
+#endif /* LDAP_PF_INET6 */
 #ifdef LDAP_PF_LOCAL
 static const struct berval     acl_bv_path_eq = BER_BVC("PATH=");
 #endif /* LDAP_PF_LOCAL */
@@ -242,7 +245,6 @@ slap_access_allowed(
                        }
                }
 
-vd_access:
                control = slap_acl_mask( a, &mask, op,
                        e, desc, val, MAXREMATCHES, matches, count, state );
 
@@ -354,7 +356,7 @@ access_allowed_mask(
                {
                        access = ACL_AUTH;
 
-               } else if ( get_manageDIT( op ) && access_level == ACL_WRITE &&
+               } else if ( get_relax( op ) && access_level == ACL_WRITE &&
                        desc == slap_schema.si_ad_entry )
                {
                        access = ACL_MANAGE;
@@ -387,14 +389,12 @@ access_allowed_mask(
                op->o_bd = LDAP_STAILQ_FIRST( &backendDB );
                be_null = 1;
 
-#ifdef LDAP_DEVEL
-               /*
-                * FIXME: experimental; use first backend rules
-                * iff there is no global_acl (ITS#3100) */
+               /* FIXME: experimental; use first backend rules
+                * iff there is no global_acl (ITS#3100)
+                */
                if ( frontendDB->be_acl != NULL ) {
                        op->o_bd = frontendDB;
                }
-#endif /* LDAP_DEVEL */
        }
        assert( op->o_bd != NULL );
 
@@ -681,7 +681,7 @@ acl_mask_dn(
         * NOTE: styles "anonymous", "users" and "self" 
         * have been moved to enum slap_style_t, whose 
         * value is set in a_dn_style; however, the string
-        * is maintaned in a_dn_pat.
+        * is maintained in a_dn_pat.
         */
 
        if ( bdn->a_style == ACL_STYLE_ANONYMOUS ) {
@@ -1101,7 +1101,7 @@ slap_acl_mask(
                         * NOTE: styles "anonymous", "users" and "self" 
                         * have been moved to enum slap_style_t, whose 
                         * value is set in a_dn_style; however, the string
-                        * is maintaned in a_dn_pat.
+                        * is maintained in a_dn_pat.
                         */
 
                        if ( acl_mask_dn( op, e, desc, val, a, nmatch, matches,
@@ -1125,7 +1125,7 @@ slap_acl_mask(
                         * NOTE: styles "anonymous", "users" and "self" 
                         * have been moved to enum slap_style_t, whose 
                         * value is set in a_dn_style; however, the string
-                        * is maintaned in a_dn_pat.
+                        * is maintained in a_dn_pat.
                         */
 
                        if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) )
@@ -1319,6 +1319,50 @@ slap_acl_mask(
                                                if ( (addr & b->a_peername_mask) != b->a_peername_addr )
                                                        continue;
 
+#ifdef LDAP_PF_INET6
+                                       /* extract IPv6 and try exact match */
+                                       } else if ( b->a_peername_style == ACL_STYLE_IPV6 ) {
+                                               char            *port;
+                                               char            buf[] = "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF";
+                                               struct berval   ip;
+                                               struct in6_addr addr;
+                                               int             port_number = -1;
+                                               
+                                               if ( strncasecmp( op->o_conn->c_peer_name.bv_val, 
+                                                                       acl_bv_ipv6_eq.bv_val,
+                                                                       acl_bv_ipv6_eq.bv_len ) != 0 ) 
+                                                       continue;
+
+                                               ip.bv_val = op->o_conn->c_peer_name.bv_val + acl_bv_ipv6_eq.bv_len;
+                                               ip.bv_len = op->o_conn->c_peer_name.bv_len - acl_bv_ipv6_eq.bv_len;
+
+                                               port = strrchr( ip.bv_val, ']' );
+                                               if ( port ) {
+                                                       ip.bv_len = port - ip.bv_val;
+                                                       ++port;
+                                                       if ( port[0] == ':' && lutil_atoi( &port_number, ++port ) != 0 )
+                                                               continue;
+                                               }
+                                               
+                                               /* the port check can be anticipated here */
+                                               if ( b->a_peername_port != -1 && port_number != b->a_peername_port )
+                                                       continue;
+                                               
+                                               /* address longer than expected? */
+                                               if ( ip.bv_len >= sizeof(buf) )
+                                                       continue;
+
+                                               AC_MEMCPY( buf, ip.bv_val, ip.bv_len );
+                                               buf[ ip.bv_len ] = '\0';
+
+                                               if ( inet_pton( AF_INET6, buf, &addr ) != 1 )
+                                                       continue;
+
+                                               /* check mask */
+                                               if ( !slap_addr6_mask( &addr, &b->a_peername_mask6, &b->a_peername_addr6 ) )
+                                                       continue;
+#endif /* LDAP_PF_INET6 */
+
 #ifdef LDAP_PF_LOCAL
                                        /* extract path and try exact match */
                                        } else if ( b->a_peername_style == ACL_STYLE_PATH ) {
@@ -1674,7 +1718,8 @@ slap_acl_mask(
                                Debug( LDAP_DEBUG_ACL, "    <= check a_dynacl: %s\n",
                                        da->da_name, 0, 0 );
 
-                               (void)( *da->da_mask )( da->da_private, op, e, desc, val, nmatch, matches, &grant, &deny );
+                               (void)da->da_mask( da->da_private, op, e, desc,
+                                       val, nmatch, matches, &grant, &deny );
 
                                tgrant |= grant;
                                tdeny |= deny;