X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Facl.c;h=62593991f6d23c03f51decbc9b84ab428cde6555;hb=4a87798893cb529d32cd77d50eab95cb361aa185;hp=f224e68e8a1b823178c7284c00ba9432fa80c11a;hpb=9129a2f7eeb1d82b4d4de7fed0bf2b3472193879;p=openldap diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c index f224e68e8a..62593991f6 100644 --- a/servers/slapd/acl.c +++ b/servers/slapd/acl.c @@ -2,7 +2,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 1998-2005 The OpenLDAP Foundation. + * Copyright 1998-2006 The OpenLDAP Foundation. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -39,46 +39,10 @@ #define ACL_BUF_SIZE 1024 /* use most appropriate size */ -/* - * speed up compares - */ -const struct berval aci_bv[] = { - BER_BVC("entry"), - BER_BVC("children"), - BER_BVC("onelevel"), - BER_BVC("subtree"), - BER_BVC("[entry]"), - BER_BVC("[all]"), - BER_BVC("access-id"), -#if 0 - BER_BVC("anonymous"), -#endif - BER_BVC("public"), - BER_BVC("users"), - BER_BVC("self"), - BER_BVC("dnattr"), - BER_BVC("group"), - BER_BVC("role"), - BER_BVC("set"), - BER_BVC("set-ref"), - BER_BVC("grant"), - BER_BVC("deny"), - - BER_BVC("IP="), +static const struct berval acl_bv_ip_eq = BER_BVC( "IP=" ); #ifdef LDAP_PF_LOCAL - BER_BVC("PATH="), -#if 0 - BER_BVC(LDAP_DIRSEP), -#endif +static const struct berval acl_bv_path_eq = BER_BVC("PATH="); #endif /* LDAP_PF_LOCAL */ - - BER_BVC(SLAPD_GROUP_CLASS), - BER_BVC(SLAPD_GROUP_ATTR), - BER_BVC(SLAPD_ROLE_CLASS), - BER_BVC(SLAPD_ROLE_ATTR), - - BER_BVC(SLAPD_ACI_SET_ATTR) -}; static AccessControl * slap_acl_get( AccessControl *ac, int *count, @@ -346,9 +310,10 @@ fe_access_allowed( */ be_orig = op->o_bd; - op->o_bd = select_backend( &op->o_req_ndn, 0, 0 ); if ( op->o_bd == NULL ) { - op->o_bd = frontendDB; + op->o_bd = select_backend( &op->o_req_ndn, 0, 0 ); + if ( op->o_bd == NULL ) + op->o_bd = frontendDB; } rc = slap_access_allowed( op, e, desc, val, access, state, maskp ); op->o_bd = be_orig; @@ -408,17 +373,15 @@ access_allowed_mask( if ( state ) { if ( state->as_vd_ad == desc ) { - if ( state->as_recorded ) { - if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) && - val == NULL ) - { - return state->as_result; + if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) && + val == NULL ) + { + return state->as_result; - } else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) && - val != NULL && state->as_vd_acl == NULL ) - { - return state->as_result; - } + } else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) && + val != NULL && state->as_vd_acl == NULL ) + { + return state->as_result; } st_same_attr = 1; } else { @@ -459,14 +422,10 @@ access_allowed_mask( desc, val, access, state, &mask ); } else { - BackendDB *be_orig = op->o_bd; - /* use default (but pass through frontend * for global ACL overlays) */ - op->o_bd = frontendDB; ret = frontendDB->bd_info->bi_access_allowed( op, e, desc, val, access, state, &mask ); - op->o_bd = be_orig; } if ( !ret ) { @@ -559,24 +518,22 @@ access_allowed_mask( if ( state ) { if ( state->as_vd_ad == desc ) { - if ( state->as_recorded ) { - if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) && - val == NULL ) - { - return state->as_result; + if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) && + val == NULL ) + { + return state->as_result; - } else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) && - val != NULL && state->as_vd_acl == NULL ) - { - return state->as_result; - } + } else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) && + val != NULL && state->as_vd_acl == NULL ) + { + return state->as_result; } st_same_attr = 1; } else { *state = state_init; } - state->as_vd_ad=desc; + state->as_vd_ad = desc; } Debug( LDAP_DEBUG_ACL, @@ -779,7 +736,7 @@ done: return ret; } -#endif /* SLAP_OVERLAY_ACCESS */ +#endif /* !SLAP_OVERLAY_ACCESS */ /* * slap_acl_get - return the acl applicable to entry e, attribute @@ -924,7 +881,7 @@ slap_acl_get( if ( a->acl_attrs[0].an_desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) { if (value_match( &match, desc, - /* desc->ad_type->sat_equality */ a->acl_attrval_mr, 0, + a->acl_attrval_mr, 0, val, &a->acl_attrval, &text ) != LDAP_SUCCESS || match ) continue; @@ -964,7 +921,7 @@ slap_acl_get( continue; } - if ( strcmp( a->acl_attrval.bv_val, val->bv_val + vdnlen - patlen )) + if ( strcmp( a->acl_attrval.bv_val, val->bv_val + vdnlen - patlen ) ) continue; } } @@ -990,6 +947,8 @@ static int acl_mask_dn( Operation *op, Entry *e, + AttributeDescription *desc, + struct berval *val, AccessControl *a, int nmatch, regmatch_t *matches, @@ -1017,6 +976,27 @@ acl_mask_dn( return 1; } + if ( b->a_self ) { + const char *dummy; + int rc, match = 0; + + /* must have DN syntax */ + if ( desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) return 1; + + /* check if the target is an attribute. */ + if ( val == NULL ) return 1; + + /* target is attribute, check if the attribute value + * is the op dn. + */ + rc = value_match( &match, desc, + desc->ad_type->sat_equality, 0, + val, opndn, &dummy ); + /* on match error or no match, fail the ACL clause */ + if ( rc != LDAP_SUCCESS || match != 0 ) + return 1; + } + } else if ( b->a_style == ACL_STYLE_SELF ) { struct berval ndn, selfndn; int level; @@ -1395,9 +1375,6 @@ slap_acl_mask( Access *b; #ifdef LDAP_DEBUG char accessmaskbuf[ACCESSMASK_MAXLEN]; -#if !defined( SLAP_DYNACL ) && defined( SLAPD_ACI_ENABLED ) - char accessmaskbuf1[ACCESSMASK_MAXLEN]; -#endif /* !SLAP_DYNACL && SLAPD_ACI_ENABLED */ #endif /* DEBUG */ const char *attr; slap_mask_t a2pmask = ACL_ACCESS2PRIV( *mask ); @@ -1453,7 +1430,7 @@ slap_acl_mask( * is maintaned in a_dn_pat. */ - if ( acl_mask_dn( op, e, a, nmatch, matches, + if ( acl_mask_dn( op, e, desc, val, a, nmatch, matches, &b->a_dn, &op->o_ndn ) ) { continue; @@ -1484,7 +1461,7 @@ slap_acl_mask( ndn = op->o_ndn; } - if ( acl_mask_dn( op, e, a, nmatch, matches, + if ( acl_mask_dn( op, e, desc, val, a, nmatch, matches, &b->a_realdn, &ndn ) ) { continue; @@ -1633,21 +1610,18 @@ slap_acl_mask( int port_number = -1; if ( strncasecmp( op->o_conn->c_peer_name.bv_val, - aci_bv[ ACI_BV_IP_EQ ].bv_val, - aci_bv[ ACI_BV_IP_EQ ].bv_len ) != 0 ) + acl_bv_ip_eq.bv_val, + acl_bv_ip_eq.bv_len ) != 0 ) continue; - ip.bv_val = op->o_conn->c_peer_name.bv_val + aci_bv[ ACI_BV_IP_EQ ].bv_len; - ip.bv_len = op->o_conn->c_peer_name.bv_len - aci_bv[ ACI_BV_IP_EQ ].bv_len; + ip.bv_val = op->o_conn->c_peer_name.bv_val + acl_bv_ip_eq.bv_len; + ip.bv_len = op->o_conn->c_peer_name.bv_len - acl_bv_ip_eq.bv_len; port = strrchr( ip.bv_val, ':' ); if ( port ) { - char *next; - ip.bv_len = port - ip.bv_val; ++port; - port_number = strtol( port, &next, 10 ); - if ( next[0] != '\0' ) + if ( lutil_atoi( &port_number, port ) != 0 ) continue; } @@ -1677,14 +1651,14 @@ slap_acl_mask( struct berval path; if ( strncmp( op->o_conn->c_peer_name.bv_val, - aci_bv[ ACI_BV_PATH_EQ ].bv_val, - aci_bv[ ACI_BV_PATH_EQ ].bv_len ) != 0 ) + acl_bv_path_eq.bv_val, + acl_bv_path_eq.bv_len ) != 0 ) continue; path.bv_val = op->o_conn->c_peer_name.bv_val - + aci_bv[ ACI_BV_PATH_EQ ].bv_len; + + acl_bv_path_eq.bv_len; path.bv_len = op->o_conn->c_peer_name.bv_len - - aci_bv[ ACI_BV_PATH_EQ ].bv_len; + - acl_bv_path_eq.bv_len; if ( ber_bvcmp( &b->a_peername_pat, &path ) != 0 ) continue; @@ -1923,7 +1897,7 @@ slap_acl_mask( bv = b->a_set_pat; } - if ( acl_match_set( &bv, op, e, 0 ) == 0 ) { + if ( acl_match_set( &bv, op, e, NULL ) == 0 ) { continue; } } @@ -1972,14 +1946,9 @@ slap_acl_mask( 0, 0, 0 ); /* this case works different from the others above. - * since aci's themselves give permissions, we need + * since dynamic ACL's themselves give permissions, we need * to first check b->a_access_mask, the ACL's access level. */ - if ( BER_BVISEMPTY( &e->e_nname ) ) { - /* no ACIs in the root DSE */ - continue; - } - /* first check if the right being requested * is allowed by the ACL clause. */ @@ -2035,164 +2004,7 @@ slap_acl_mask( } } else -#else /* !SLAP_DYNACL */ - -#ifdef SLAPD_ACI_ENABLED - if ( b->a_aci_at != NULL ) { - Attribute *at; - slap_access_t grant, deny, tgrant, tdeny; - struct berval parent_ndn; - BerVarray bvals = NULL; - int ret, stop; - - Debug( LDAP_DEBUG_ACL, " <= check a_aci_at: %s\n", - b->a_aci_at->ad_cname.bv_val, 0, 0 ); - - /* this case works different from the others above. - * since aci's themselves give permissions, we need - * to first check b->a_access_mask, the ACL's access level. - */ - - if ( BER_BVISEMPTY( &e->e_nname ) ) { - /* no ACIs in the root DSE */ - continue; - } - - /* first check if the right being requested - * is allowed by the ACL clause. - */ - if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) { - continue; - } - /* start out with nothing granted, nothing denied */ - ACL_INIT(tgrant); - ACL_INIT(tdeny); - - /* get the aci attribute */ - at = attr_find( e->e_attrs, b->a_aci_at ); - if ( at != NULL ) { -#if 0 - /* FIXME: this breaks acl caching; - * see also ACL_RECORD_VALUE_STATE below */ - ACL_RECORD_VALUE_STATE; -#endif - /* the aci is an multi-valued attribute. The - * rights are determined by OR'ing the individual - * rights given by the acis. - */ - for ( i = 0; !BER_BVISNULL( &at->a_nvals[i] ); i++ ) { - if ( aci_mask( op, - e, desc, val, - &at->a_nvals[i], - nmatch, matches, - &grant, &deny, SLAP_ACI_SCOPE_ENTRY ) != 0 ) - { - tgrant |= grant; - tdeny |= deny; - } - } - Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n", - accessmask2str(tgrant, accessmaskbuf, 1), - accessmask2str(tdeny, accessmaskbuf1, 1), 0); - - } - /* If the entry level aci didn't contain anything valid for the - * current operation, climb up the tree and evaluate the - * acis with scope set to subtree - */ - if ( (tgrant == ACL_PRIV_NONE) && (tdeny == ACL_PRIV_NONE) ) { - dnParent( &e->e_nname, &parent_ndn ); - while ( !BER_BVISEMPTY( &parent_ndn ) ) { - Debug(LDAP_DEBUG_ACL, "checking ACI of %s\n", parent_ndn.bv_val, 0, 0); - ret = backend_attribute(op, NULL, &parent_ndn, b->a_aci_at, &bvals, ACL_AUTH); - switch(ret){ - case LDAP_SUCCESS : - stop = 0; - if (!bvals){ - break; - } - - for ( i = 0; !BER_BVISNULL( &bvals[i] ); i++ ) { -#if 0 - /* FIXME: this breaks acl caching; - * see also ACL_RECORD_VALUE_STATE above */ - ACL_RECORD_VALUE_STATE; -#endif - if ( aci_mask( op, e, desc, val, &bvals[i], - nmatch, matches, - &grant, &deny, SLAP_ACI_SCOPE_CHILDREN ) != 0 ) - { - tgrant |= grant; - tdeny |= deny; - /* evaluation stops as soon as either a "deny" or a - * "grant" directive matches. - */ - if( (tgrant != ACL_PRIV_NONE) || (tdeny != ACL_PRIV_NONE) ){ - stop = 1; - } - } - Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n", - accessmask2str(tgrant, accessmaskbuf, 1), - accessmask2str(tdeny, accessmaskbuf1, 1), 0); - } - break; - - case LDAP_NO_SUCH_ATTRIBUTE: - /* just go on if the aci-Attribute is not present in - * the current entry - */ - Debug(LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0); - stop = 0; - break; - - case LDAP_NO_SUCH_OBJECT: - /* We have reached the base object */ - Debug(LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0); - stop = 1; - break; - - default: - stop = 1; - break; - } - if (stop){ - break; - } - dnParent( &parent_ndn, &parent_ndn ); - } - } - - - /* remove anything that the ACL clause does not allow */ - tgrant &= b->a_access_mask & ACL_PRIV_MASK; - tdeny &= ACL_PRIV_MASK; - - /* see if we have anything to contribute */ - if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) { - continue; - } - - /* this could be improved by changing slap_acl_mask so that it can deal with - * by clauses that return grant/deny pairs. Right now, it does either - * additive or subtractive rights, but not both at the same time. So, - * we need to combine the grant/deny pair into a single rights mask in - * a smart way: if either grant or deny is "empty", then we use the - * opposite as is, otherwise we remove any denied rights from the grant - * rights mask and construct an additive mask. - */ - if (ACL_IS_INVALID(tdeny)) { - modmask = tgrant | ACL_PRIV_ADDITIVE; - - } else if (ACL_IS_INVALID(tgrant)) { - modmask = tdeny | ACL_PRIV_SUBSTRACTIVE; - - } else { - modmask = (tgrant & ~tdeny) | ACL_PRIV_ADDITIVE; - } - - } else -#endif /* SLAPD_ACI_ENABLED */ -#endif /* !SLAP_DYNACL */ +#endif /* SLAP_DYNACL */ { modmask = b->a_access_mask; } @@ -2327,6 +2139,7 @@ acl_check_modlist( switch ( mlist->sml_op ) { case LDAP_MOD_REPLACE: + case LDAP_MOD_INCREMENT: /* * We must check both permission to delete the whole * attribute and permission to add the specific attributes. @@ -2603,7 +2416,7 @@ acl_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *de op2.o_tag = LDAP_REQ_SEARCH; op2.o_ndn = op2.o_bd->be_rootndn; op2.o_callback = &cb; - op2.o_time = slap_get_time(); + slap_op_time( &op2.o_time, &op2.o_tincr ); op2.o_do_not_cache = 1; op2.o_is_auth_check = 0; ber_dupbv_x( &op2.o_req_dn, &op2.o_req_ndn, cp->asc_op->o_tmpmemctx ); @@ -2679,13 +2492,13 @@ acl_match_set ( struct berval *subj, Operation *op, Entry *e, - int setref ) + struct berval *default_set_attribute ) { struct berval set = BER_BVNULL; int rc = 0; AclSetCookie cookie; - if ( setref == 0 ) { + if ( default_set_attribute == NULL ) { ber_dupbv_x( &set, subj, op->o_tmpmemctx ); } else { @@ -2701,7 +2514,7 @@ acl_match_set ( } if ( acl_get_part( subj, 1, '/', &setat ) < 0 ) { - setat = aci_bv[ ACI_BV_SET_ATTR ]; + setat = *default_set_attribute; } /* @@ -2798,23 +2611,33 @@ slap_dynacl_get( const char *name ) } #endif /* SLAP_DYNACL */ +/* + * statically built-in dynamic ACL initialization + */ +static int (*acl_init_func[])( void ) = { +#ifdef SLAP_DYNACL + /* TODO: remove when ACI will only be dynamic */ +#if SLAPD_ACI_ENABLED == SLAPD_MOD_STATIC + dynacl_aci_init, +#endif /* SLAPD_ACI_ENABLED */ +#endif /* SLAP_DYNACL */ + + NULL +}; + int acl_init( void ) { - int rc = 0; + int i, rc; -#ifdef SLAPD_ACI_ENABLED -#ifdef SLAP_DYNACL - rc = dynacl_aci_init(); -#else /* !SLAP_DYNACL */ - rc = aci_init(); -#endif /* !SLAP_DYNACL */ - if ( rc != 0 ) { - return rc; + for ( i = 0; acl_init_func[ i ] != NULL; i++ ) { + rc = (*(acl_init_func[ i ]))(); + if ( rc != 0 ) { + return rc; + } } -#endif /* SLAPD_ACI_ENABLED */ - return rc; + return 0; } int