ITS#3549 cleanup abandon/cancel processing

[openldap] / servers / slapd / aclparse.c

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index d7a99c0351d55a7169bba68e7806d0ff09ffac51..d682ef7c5178f7eba1e59a673e373eb59fa93caa 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -62,10 +62,7 @@ static void          print_acl(Backend *be, AccessControl *a);
 static void            print_access(Access *b);
 #endif
 
-#ifdef LDAP_DEVEL
-static int
-check_scope( BackendDB *be, AccessControl *a );
-#endif /* LDAP_DEVEL */
+static int             check_scope( BackendDB *be, AccessControl *a );
 
 #ifdef SLAP_DYNACL
 static int
@@ -160,7 +157,6 @@ regtest(const char *fname, int lineno, char *pat) {
        regfree(&re);
 }
 
-#ifdef LDAP_DEVEL
 /*
  * Experimental
  *
@@ -181,6 +177,10 @@ check_scope( BackendDB *be, AccessControl *a )
 
        dn = be->be_nsuffix[0];
 
+       if ( BER_BVISEMPTY( &dn ) ) {
+               return ACL_SCOPE_OK;
+       }
+
        if ( !BER_BVISEMPTY( &a->acl_dn_pat ) ||
                        a->acl_dn_style != ACL_STYLE_REGEX )
        {
@@ -295,7 +295,6 @@ regex_done:;
 
        return ACL_SCOPE_UNKNOWN;
 }
-#endif /* LDAP_DEVEL */
 
 void
 parse_acl(
@@ -303,8 +302,7 @@ parse_acl(
     const char *fname,
     int                lineno,
     int                argc,
-    char       **argv
-)
+    char       **argv )
 {
        int             i;
        char            *left, *right, *style, *next;
@@ -506,7 +504,7 @@ parse_acl(
                                                                        a->acl_attrs[0].an_desc->ad_cname.bv_val );
                                                                a->acl_attrval_style = ACL_STYLE_BASE;
                                                        }
-                                                       
+
                                                } else {
                                                        fprintf( stderr, 
                                                                "%s: line %d: unknown val.<style> \"%s\" "
@@ -1050,7 +1048,7 @@ parse_acl(
                                                acl_usage();
                                        }
 
-                                       if ( BER_BVISEMPTY( &b->a_peername_pat ) ) {
+                                       if ( !BER_BVISEMPTY( &b->a_peername_pat ) ) {
                                                fprintf( stderr, "%s: line %d: "
                                                        "peername pattern already specified.\n",
                                                        fname, lineno );
@@ -1653,7 +1651,6 @@ parse_acl(
                }
 
                if ( be != NULL ) {
-#ifdef LDAP_DEVEL
                        if ( !BER_BVISNULL( &be->be_nsuffix[ 1 ] ) ) {
                                fprintf( stderr, "%s: line %d: warning: "
                                        "scope checking only applies to single-valued "
@@ -1693,7 +1690,6 @@ parse_acl(
                        default:
                                break;
                        }
-#endif /* LDAP_DEVEL */
                        acl_append( &be->be_acl, a );
 
                } else {
@@ -1720,6 +1716,9 @@ accessmask2str( slap_mask_t mask, char *buf )
                if ( ACL_LVL_IS_NONE(mask) ) {
                        ptr = lutil_strcopy( ptr, "none" );
 
+               } else if ( ACL_LVL_IS_DISCLOSE(mask) ) {
+                       ptr = lutil_strcopy( ptr, "disclose" );
+
                } else if ( ACL_LVL_IS_AUTH(mask) ) {
                        ptr = lutil_strcopy( ptr, "auth" );
 
@@ -1734,6 +1733,10 @@ accessmask2str( slap_mask_t mask, char *buf )
 
                } else if ( ACL_LVL_IS_WRITE(mask) ) {
                        ptr = lutil_strcopy( ptr, "write" );
+
+               } else if ( ACL_LVL_IS_MANAGE(mask) ) {
+                       ptr = lutil_strcopy( ptr, "manage" );
+
                } else {
                        ptr = lutil_strcopy( ptr, "unknown" );
                }
@@ -1751,6 +1754,11 @@ accessmask2str( slap_mask_t mask, char *buf )
                *ptr++ = '=';
        }
 
+       if ( ACL_PRIV_ISSET(mask, ACL_PRIV_MANAGE) ) {
+               none = 0;
+               *ptr++ = 'm';
+       } 
+
        if ( ACL_PRIV_ISSET(mask, ACL_PRIV_WRITE) ) {
                none = 0;
                *ptr++ = 'w';
@@ -1776,6 +1784,11 @@ accessmask2str( slap_mask_t mask, char *buf )
                *ptr++ = 'x';
        } 
 
+       if ( ACL_PRIV_ISSET(mask, ACL_PRIV_DISCLOSE) ) {
+               none = 0;
+               *ptr++ = 'd';
+       } 
+
        if ( none && ACL_PRIV_ISSET(mask, ACL_PRIV_NONE) ) {
                none = 0;
                *ptr++ = 'n';
@@ -1817,7 +1830,10 @@ str2accessmask( const char *str )
                }
 
                for( i=1; str[i] != '\0'; i++ ) {
-                       if( TOLOWER((unsigned char) str[i]) == 'w' ) {
+                       if( TOLOWER((unsigned char) str[i]) == 'm' ) {
+                               ACL_PRIV_SET(mask, ACL_PRIV_MANAGE);
+
+                       } else if( TOLOWER((unsigned char) str[i]) == 'w' ) {
                                ACL_PRIV_SET(mask, ACL_PRIV_WRITE);
 
                        } else if( TOLOWER((unsigned char) str[i]) == 'r' ) {
@@ -1832,6 +1848,9 @@ str2accessmask( const char *str )
                        } else if( TOLOWER((unsigned char) str[i]) == 'x' ) {
                                ACL_PRIV_SET(mask, ACL_PRIV_AUTH);
 
+                       } else if( TOLOWER((unsigned char) str[i]) == 'd' ) {
+                               ACL_PRIV_SET(mask, ACL_PRIV_DISCLOSE);
+
                        } else if( str[i] != '0' ) {
                                ACL_INVALIDATE(mask);
                                return mask;
@@ -1844,6 +1863,9 @@ str2accessmask( const char *str )
        if ( strcasecmp( str, "none" ) == 0 ) {
                ACL_LVL_ASSIGN_NONE(mask);
 
+       } else if ( strcasecmp( str, "disclose" ) == 0 ) {
+               ACL_LVL_ASSIGN_DISCLOSE(mask);
+
        } else if ( strcasecmp( str, "auth" ) == 0 ) {
                ACL_LVL_ASSIGN_AUTH(mask);
 
@@ -1859,6 +1881,9 @@ str2accessmask( const char *str )
        } else if ( strcasecmp( str, "write" ) == 0 ) {
                ACL_LVL_ASSIGN_WRITE(mask);
 
+       } else if ( strcasecmp( str, "manage" ) == 0 ) {
+               ACL_LVL_ASSIGN_MANAGE(mask);
+
        } else {
                ACL_INVALIDATE( mask );
        }
@@ -1873,7 +1898,7 @@ acl_usage( void )
                "<access clause> ::= access to <what> "
                                "[ by <who> <access> [ <control> ] ]+ \n"
                "<what> ::= * | [dn[.<dnstyle>]=<DN>] [filter=<filter>] [attrs=<attrlist>]\n"
-               "<attrlist> ::= <attr> [val[.<style>]=<value>] | <attr> , <attrlist>\n"
+               "<attrlist> ::= <attr> [val[.<attrstyle>]=<value>] | <attr> , <attrlist>\n"
                "<attr> ::= <attrname> | entry | children\n",
                "<who> ::= [ * | anonymous | users | self | dn[.<dnstyle>]=<DN> ]\n"
                        "\t[dnattr=<attrname>]\n"
@@ -1884,14 +1909,16 @@ acl_usage( void )
                        "\t[aci=<attrname>]\n"
 #endif
                        "\t[ssf=<n>] [transport_ssf=<n>] [tls_ssf=<n>] [sasl_ssf=<n>]\n",
+               "<style> ::= exact | regex | base(Object)\n"
                "<dnstyle> ::= base(Object) | one(level) | sub(tree) | children | "
                        "exact | regex\n"
-               "<style> ::= exact | regex | base(Object)\n"
+               "<attrstyle> ::= exact | regex | base(Object) | one(level) | "
+                       "sub(tree) | children\n"
                "<peernamestyle> ::= exact | regex | ip | path\n"
                "<domainstyle> ::= exact | regex | base(Object) | sub(tree)\n"
                "<access> ::= [self]{<level>|<priv>}\n"
-               "<level> ::= none | auth | compare | search | read | write\n"
-               "<priv> ::= {=|+|-}{w|r|s|c|x|0}+\n"
+               "<level> ::= none|disclose|auth|compare|search|read|write|manage\n"
+               "<priv> ::= {=|+|-}{0|d|x|c|s|r|w|m}+\n"
                "<control> ::= [ stop | continue | break ]\n"
        );
        exit( EXIT_FAILURE );
@@ -2053,6 +2080,9 @@ access2str( slap_access_t access )
        if ( access == ACL_NONE ) {
                return "none";
 
+       } else if ( access == ACL_DISCLOSE ) {
+               return "disclose";
+
        } else if ( access == ACL_AUTH ) {
                return "auth";
 
@@ -2067,6 +2097,10 @@ access2str( slap_access_t access )
 
        } else if ( access == ACL_WRITE ) {
                return "write";
+
+       } else if ( access == ACL_MANAGE ) {
+               return "manage";
+
        }
 
        return "unknown";
@@ -2078,6 +2112,9 @@ str2access( const char *str )
        if ( strcasecmp( str, "none" ) == 0 ) {
                return ACL_NONE;
 
+       } else if ( strcasecmp( str, "disclose" ) == 0 ) {
+               return ACL_DISCLOSE;
+
        } else if ( strcasecmp( str, "auth" ) == 0 ) {
                return ACL_AUTH;
 
@@ -2092,6 +2129,9 @@ str2access( const char *str )
 
        } else if ( strcasecmp( str, "write" ) == 0 ) {
                return ACL_WRITE;
+
+       } else if ( strcasecmp( str, "manage" ) == 0 ) {
+               return ACL_MANAGE;
        }
 
        return( ACL_INVALID_ACCESS );
@@ -2240,8 +2280,11 @@ print_acl( Backend *be, AccessControl *a )
                        if ( ! first ) fprintf( stderr, "," );
                        if (an->an_oc) {
                                fputc( an->an_oc_exclude ? '!' : '@', stderr);
+                               fputs( an->an_oc->soc_cname.bv_val, stderr );
+
+                       } else {
+                               fputs( an->an_name.bv_val, stderr );
                        }
-                       fputs( an->an_name.bv_val, stderr );
                        first = 0;
                }
                fprintf(  stderr, "\n" );