ITS#1716 is_entry_subentr/ies/y/

[openldap] / servers / slapd / aclparse.c

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index c920d7b696d744259a1e11a171dff4c17e6ca0dc..95397c2668eb71b7d04639b4e679df4f75d082bc 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -16,6 +16,7 @@
 #include <ac/unistd.h>
 
 #include "slap.h"
+#include "lber_pvt.h"
 
 static void            split(char *line, int splitchar, char **left, char **right);
 static void            access_append(Access **l, Access *a);
@@ -279,9 +280,14 @@ parse_acl(
                        /* get <who> */
                        for ( ; i < argc; i++ ) {
                                slap_style_t sty = ACL_STYLE_REGEX;
+                               char *style_modifier = NULL;
+                               int expand = 0;
 
                                split( argv[i], '=', &left, &right );
                                split( left, '.', &left, &style );
+                               if ( style ) {
+                                       split( style, ',', &style, &style_modifier);
+                               }
                                if ( style == NULL || *style == '\0'
                                        || strcasecmp( style, "regex" ) == 0 )
                                {
@@ -303,6 +309,10 @@ parse_acl(
                                        acl_usage();
                                }
 
+                               if ( style_modifier && strcasecmp( style_modifier, "expand" ) == 0 ) {
+                                       expand = 1;
+                               }
+
                                if ( strcasecmp( argv[i], "*" ) == 0 ) {
                                        bv.bv_val = ch_strdup( "*" );
                                        bv.bv_len = 1;
@@ -365,7 +375,9 @@ parse_acl(
                                                } else {
                                                        bv.bv_val = right;
                                                        acl_regex_normalized_dn( &bv );
-                                                       regtest(fname, lineno, bv.bv_val);
+                                                       if ( !ber_bvccmp( &bv, '*' ) ) {
+                                                               regtest(fname, lineno, bv.bv_val);
+                                                       }
                                                }
                                        } else if ( right == NULL || *right == '\0' ) {
                                                fprintf( stderr,
@@ -389,13 +401,14 @@ parse_acl(
                                                acl_usage();
                                        }
 
-                                       if ( sty != ACL_STYLE_REGEX ) {
+                                       if ( sty != ACL_STYLE_REGEX && expand == 0 ) {
                                                dnNormalize2(NULL, &bv, &b->a_dn_pat);
                                                free(bv.bv_val);
                                        } else {
                                                b->a_dn_pat = bv;
                                        }
                                        b->a_dn_style = sty;
+                                       b->a_dn_expand = expand;
                                        continue;
                                }
 
@@ -440,17 +453,17 @@ parse_acl(
                                        continue;
                                }
 
-                               if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
-                                       fprintf( stderr,
-                                               "%s: line %d: inappropriate style \"%s\" in by clause\n",
-                                           fname, lineno, style );
-                                       acl_usage();
-                               }
-
                                if ( strncasecmp( left, "group", sizeof("group")-1 ) == 0 ) {
                                        char *name = NULL;
                                        char *value = NULL;
 
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if ( right == NULL || right[ 0 ] == '\0' ) {
                                                fprintf( stderr,
                                                        "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
@@ -479,7 +492,9 @@ parse_acl(
                                        if (sty == ACL_STYLE_REGEX) {
                                                bv.bv_val = right;
                                                acl_regex_normalized_dn( &bv );
-                                               regtest(fname, lineno, bv.bv_val);
+                                               if ( !ber_bvccmp( &bv, '*' ) ) {
+                                                       regtest(fname, lineno, bv.bv_val);
+                                               }
                                                b->a_group_pat = bv;
                                        } else {
                                                ber_str2bv( right, 0, 0, &bv );
@@ -587,6 +602,13 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "peername" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if ( right == NULL || right[ 0 ] == '\0' ) {
                                                fprintf( stderr,
                                                        "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
@@ -605,7 +627,9 @@ parse_acl(
                                        if (sty == ACL_STYLE_REGEX) {
                                                bv.bv_val = right;
                                                acl_regex_normalized_dn( &bv );
-                                               regtest(fname, lineno, bv.bv_val);
+                                               if ( !ber_bvccmp( &bv, '*' ) ) {
+                                                       regtest(fname, lineno, bv.bv_val);
+                                               }
                                                b->a_peername_pat = bv;
                                        } else {
                                                ber_str2bv( right, 0, 1, &b->a_peername_pat );
@@ -614,6 +638,13 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "sockname" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if ( right == NULL || right[ 0 ] == '\0' ) {
                                                fprintf( stderr,
                                                        "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
@@ -632,7 +663,9 @@ parse_acl(
                                        if (sty == ACL_STYLE_REGEX) {
                                                bv.bv_val = right;
                                                acl_regex_normalized_dn( &bv );
-                                               regtest(fname, lineno, bv.bv_val);
+                                               if ( !ber_bvccmp( &bv, '*' ) ) {
+                                                       regtest(fname, lineno, bv.bv_val);
+                                               }
                                                b->a_sockname_pat = bv;
                                        } else {
                                                ber_str2bv( right, 0, 1, &b->a_sockname_pat );
@@ -641,6 +674,19 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "domain" ) == 0 ) {
+                                       switch ( sty ) {
+                                       case ACL_STYLE_REGEX:
+                                       case ACL_STYLE_BASE:
+                                       case ACL_STYLE_SUBTREE:
+                                               break;
+
+                                       default:
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if ( right == NULL || right[ 0 ] == '\0' ) {
                                                fprintf( stderr,
                                                        "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
@@ -656,10 +702,13 @@ parse_acl(
                                        }
 
                                        b->a_domain_style = sty;
+                                       b->a_domain_expand = expand;
                                        if (sty == ACL_STYLE_REGEX) {
                                                bv.bv_val = right;
                                                acl_regex_normalized_dn( &bv );
-                                               regtest(fname, lineno, bv.bv_val);
+                                               if ( !ber_bvccmp( &bv, '*' ) ) {
+                                                       regtest(fname, lineno, bv.bv_val);
+                                               }
                                                b->a_domain_pat = bv;
                                        } else {
                                                ber_str2bv( right, 0, 1, &b->a_domain_pat );
@@ -668,6 +717,13 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "sockurl" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if ( right == NULL || right[ 0 ] == '\0' ) {
                                                fprintf( stderr,
                                                        "%s: line %d: missing \"=\" in (or value after) \"%s\" in by clause\n",
@@ -686,7 +742,9 @@ parse_acl(
                                        if (sty == ACL_STYLE_REGEX) {
                                                bv.bv_val = right;
                                                acl_regex_normalized_dn( &bv );
-                                               regtest(fname, lineno, bv.bv_val);
+                                               if ( !ber_bvccmp( &bv, '*' ) ) {
+                                                       regtest(fname, lineno, bv.bv_val);
+                                               }
                                                b->a_sockurl_pat = bv;
                                        } else {
                                                ber_str2bv( right, 0, 1, &b->a_sockurl_pat );
@@ -695,6 +753,13 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "set" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if( b->a_set_pat.bv_len != 0 ) {
                                                fprintf( stderr,
                                                        "%s: line %d: set attribute already specified.\n",
@@ -717,6 +782,13 @@ parse_acl(
 
 #ifdef SLAPD_ACI_ENABLED
                                if ( strcasecmp( left, "aci" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if( b->a_aci_at != NULL ) {
                                                fprintf( stderr,
                                                        "%s: line %d: aci attribute already specified.\n",
@@ -753,6 +825,13 @@ parse_acl(
 #endif /* SLAPD_ACI_ENABLED */
 
                                if ( strcasecmp( left, "ssf" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if( b->a_authz.sai_ssf ) {
                                                fprintf( stderr,
                                                        "%s: line %d: ssf attribute already specified.\n",
@@ -779,6 +858,13 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "transport_ssf" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if( b->a_authz.sai_transport_ssf ) {
                                                fprintf( stderr,
                                                        "%s: line %d: transport_ssf attribute already specified.\n",
@@ -805,6 +891,13 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "tls_ssf" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if( b->a_authz.sai_tls_ssf ) {
                                                fprintf( stderr,
                                                        "%s: line %d: tls_ssf attribute already specified.\n",
@@ -831,6 +924,13 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "sasl_ssf" ) == 0 ) {
+                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                               fprintf( stderr,
+                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                                   fname, lineno, style );
+                                               acl_usage();
+                                       }
+
                                        if( b->a_authz.sai_sasl_ssf ) {
                                                fprintf( stderr,
                                                        "%s: line %d: sasl_ssf attribute already specified.\n",