/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 1998-2006 The OpenLDAP Foundation.
+ * Copyright 1998-2009 The OpenLDAP Foundation.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
#include "lutil.h"
static const char style_base[] = "base";
-char *style_strings[] = {
+const char *style_strings[] = {
"regex",
"expand",
"exact",
"users",
"self",
"ip",
+ "ipv6",
"path",
NULL
};
if ( style != NULL ) {
if ( strcasecmp( style, "regex" ) == 0 ) {
int e = regcomp( &a->acl_attrval_re, bv.bv_val,
- REG_EXTENDED | REG_ICASE | REG_NOSUB );
+ REG_EXTENDED | REG_ICASE );
if ( e ) {
char err[SLAP_TEXT_BUFLEN],
buf[ SLAP_TEXT_BUFLEN ];
}
}
- /* expand in <who> needs regex in <what> */
- if ( ( sty == ACL_STYLE_EXPAND || expand )
- && a->acl_dn_style != ACL_STYLE_REGEX )
- {
- Debug( LDAP_DEBUG_CONFIG | LDAP_DEBUG_ACL, "%s: line %d: \"expand\" style "
- "or modifier used in conjunction with a non-regex <what> clause.\n",
- fname, lineno, 0 );
- goto fail;
- }
-
if ( strncasecmp( left, "real", STRLENOF( "real" ) ) == 0 ) {
is_realdn = 1;
bdn = &b->a_realdn;
< bdn->a_pat.bv_len;
exp = strchr( exp, '$' ) )
{
- if ( isdigit( (unsigned char) exp[ 1 ] ) ) {
+ if ( ( isdigit( (unsigned char) exp[ 1 ] ) ||
+ exp[ 1 ] == '{' ) ) {
gotit = 1;
break;
}
if ( strncasecmp( left, "group", STRLENOF( "group" ) ) == 0 ) {
char *name = NULL;
char *value = NULL;
+ char *attr_name = SLAPD_GROUP_ATTR;
switch ( sty ) {
case ACL_STYLE_REGEX:
}
if ( name && *name ) {
- rc = slap_str2ad( name, &b->a_group_at, &text );
-
- if( rc != LDAP_SUCCESS ) {
- char buf[ SLAP_TEXT_BUFLEN ];
-
- snprintf( buf, sizeof( buf ),
- "group \"%s\": %s.",
- right, text );
- Debug( LDAP_DEBUG_ANY,
- "%s: line %d: %s\n",
- fname, lineno, buf );
- goto fail;
- }
+ attr_name = name;
*--name = '/';
- } else {
- rc = slap_str2ad( SLAPD_GROUP_ATTR, &b->a_group_at, &text );
+ }
- if ( rc != LDAP_SUCCESS ) {
- char buf[ SLAP_TEXT_BUFLEN ];
+ rc = slap_str2ad( attr_name, &b->a_group_at, &text );
+ if ( rc != LDAP_SUCCESS ) {
+ char buf[ SLAP_TEXT_BUFLEN ];
- snprintf( buf, sizeof( buf ),
- "group \"%s\": %s.",
- SLAPD_GROUP_ATTR, text );
- Debug( LDAP_DEBUG_ANY,
- "%s: line %d: %s\n",
- fname, lineno, buf );
- goto fail;
- }
+ snprintf( buf, sizeof( buf ),
+ "group \"%s\": %s.",
+ right, text );
+ Debug( LDAP_DEBUG_ANY,
+ "%s: line %d: %s\n",
+ fname, lineno, buf );
+ goto fail;
}
if ( !is_at_syntax( b->a_group_at->ad_type,
- SLAPD_DN_SYNTAX ) &&
- !is_at_syntax( b->a_group_at->ad_type,
- SLAPD_NAMEUID_SYNTAX ) &&
- !is_at_subtype( b->a_group_at->ad_type, slap_schema.si_ad_labeledURI->ad_type ) )
+ SLAPD_DN_SYNTAX ) /* e.g. "member" */
+ && !is_at_syntax( b->a_group_at->ad_type,
+ SLAPD_NAMEUID_SYNTAX ) /* e.g. memberUID */
+ && !is_at_subtype( b->a_group_at->ad_type,
+ slap_schema.si_ad_labeledURI->ad_type ) /* e.g. memberURL */ )
{
char buf[ SLAP_TEXT_BUFLEN ];
snprintf( buf, sizeof( buf ),
- "group \"%s\": inappropriate syntax: %s.",
+ "group \"%s\" attr \"%s\": inappropriate syntax: %s; "
+ "must be " SLAPD_DN_SYNTAX " (DN), "
+ SLAPD_NAMEUID_SYNTAX " (NameUID) "
+ "or a subtype of labeledURI.",
right,
- b->a_group_at->ad_type->sat_syntax_oid );
+ attr_name,
+ at_syntax( b->a_group_at->ad_type ) );
Debug( LDAP_DEBUG_ANY,
"%s: line %d: %s\n",
fname, lineno, buf );
"exact | regex\n"
"<attrstyle> ::= exact | regex | base(Object) | one(level) | "
"sub(tree) | children\n"
- "<peernamestyle> ::= exact | regex | ip | path\n"
+ "<peernamestyle> ::= exact | regex | ip | ipv6 | path\n"
"<domainstyle> ::= exact | regex | base(Object) | sub(tree)\n"
"<access> ::= [[real]self]{<level>|<priv>}\n"
"<level> ::= none|disclose|auth|compare|search|read|{write|add|delete}|manage\n"
free( a );
}
-/* Because backend_startup uses acl_append to tack on the global_acl to
- * the end of each backend's acl, we cannot just take one argument and
- * merrily free our way to the end of the list. backend_destroy calls us
- * with the be_acl in arg1, and global_acl in arg2 to give us a stopping
- * point. config_destroy calls us with global_acl in arg1 and NULL in
- * arg2, so we then proceed to polish off the global_acl.
- */
void
-acl_destroy( AccessControl *a, AccessControl *end )
+acl_destroy( AccessControl *a )
{
AccessControl *n;
- for ( ; a && a != end; a = n ) {
+ for ( ; a; a = n ) {
n = a->acl_next;
acl_free( a );
}
for ( an = a->acl_attrs; an && !BER_BVISNULL( &an->an_name ); an++ ) {
if ( ! first ) *ptr++ = ',';
if (an->an_oc) {
- *ptr++ = an->an_oc_exclude ? '!' : '@';
+ *ptr++ = ( an->an_flags & SLAP_AN_OCEXCLUDE ) ? '!' : '@';
ptr = lutil_strcopy( ptr, an->an_oc->soc_cname.bv_val );
} else {
projects / openldap / blobdiff