X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Facl.c;h=c648d4ef6fb6dcabf90ac232bfe29f5b718c7231;hb=0a5f1e8516d386784ed7f605e5d03c7ee6d7cedd;hp=143d53d18dcd92648904169901f1766ee5a45f7d;hpb=c75be97ae946dab41f002a31d8347cc38cda7658;p=openldap diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c index 143d53d18d..c648d4ef6f 100644 --- a/servers/slapd/acl.c +++ b/servers/slapd/acl.c @@ -1,8 +1,27 @@ /* acl.c - routines to parse and check acl's */ /* $OpenLDAP$ */ -/* - * Copyright 1998-2003 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2003 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ +/* Portions Copyright (c) 1995 Regents of the University of Michigan. + * All rights reserved. + * + * Redistribution and use in source and binary forms are permitted + * provided that this notice is preserved and that due credit is given + * to the University of Michigan at Ann Arbor. The name of the University + * may not be used to endorse or promote products derived from this + * software without specific prior written permission. This software + * is provided ``as is'' without express or implied warranty. */ #include "portable.h" @@ -24,6 +43,7 @@ */ static struct berval aci_bv_entry = BER_BVC("entry"), + aci_bv_children = BER_BVC("children"), aci_bv_br_entry = BER_BVC("[entry]"), aci_bv_br_all = BER_BVC("[all]"), aci_bv_access_id = BER_BVC("access-id"), @@ -49,6 +69,7 @@ static AccessControl * acl_get( AccessControl *ac, int *count, Operation *op, Entry *e, AttributeDescription *desc, + struct berval *val, int nmatches, regmatch_t *matches ); static slap_control_t acl_mask( @@ -68,7 +89,8 @@ static int aci_mask( struct berval *aci, regmatch_t *matches, slap_access_t *grant, - slap_access_t *deny ); + slap_access_t *deny, + struct berval *scope); #endif static int regex_matches( @@ -135,9 +157,12 @@ access_allowed( assert( attr != NULL ); - if( op && op->o_is_auth_check && (access == ACL_SEARCH || access == ACL_READ)) { + if( op && op->o_is_auth_check && + ( access == ACL_SEARCH || access == ACL_READ )) + { access = ACL_AUTH; } + if( state && state->as_recorded && state->as_vd_ad==desc) { if( state->as_recorded & ACL_STATE_RECORDED_NV && val == NULL ) @@ -150,7 +175,9 @@ access_allowed( return state->as_result; } st_same_attr = 1; - } if (state) { + } + + if( state ) { state->as_vd_ad=desc; } @@ -169,6 +196,14 @@ access_allowed( goto done; } +#ifdef LDAP_SLAPI + if ( op->o_pb && + !slapi_x_access_allowed( op, e, desc, val, access, state )) { + /* ACL plugin denied access */ + goto done; + } +#endif /* LDAP_SLAPI */ + be = op->o_bd; if ( be == NULL ) { be = &backends[0]; @@ -219,12 +254,13 @@ access_allowed( "access_allowed: backend default %s access %s to \"%s\"\n", access2str( access ), be->be_dfltaccess >= access ? "granted" : "denied", - op->o_dn.bv_val ); + op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" ); #else Debug( LDAP_DEBUG_ACL, "=> access_allowed: backend default %s access %s to \"%s\"\n", access2str( access ), - be->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val ); + be->be_dfltaccess >= access ? "granted" : "denied", + op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" ); #endif ret = be->be_dfltaccess >= access; goto done; @@ -259,18 +295,18 @@ access_allowed( a = state->as_vd_acl; mask = state->as_vd_acl_mask; count = state->as_vd_acl_count; - AC_MEMCPY( matches, state->as_vd_acl_matches, - sizeof(matches) ); + AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) ); goto vd_access; } else { + if ( state ) state->as_vi_acl = NULL; a = NULL; ACL_INIT(mask); count = 0; memset(matches, '\0', sizeof(matches)); } - while((a = acl_get( a, &count, op, e, desc, + while((a = acl_get( a, &count, op, e, desc, val, MAXREMATCHES, matches )) != NULL) { int i; @@ -300,7 +336,8 @@ access_allowed( if (state) { if (state->as_vi_acl == a && (state->as_recorded & ACL_STATE_RECORDED_NV)) { Debug( LDAP_DEBUG_ACL, "access_allowed: result from state (%s)\n", attr, 0, 0 ); - return state->as_result; + ret = state->as_result; + goto done; } else if (!st_initialized) { Debug( LDAP_DEBUG_ACL, "access_allowed: no res from state (%s)\n", attr, 0, 0); *state = state_init; @@ -362,10 +399,11 @@ vd_access: done: if( state != NULL ) { /* If not value-dependent, save ACL in case of more attrs */ - if ( !(state->as_recorded & ACL_STATE_RECORDED_VD) ) + if ( !(state->as_recorded & ACL_STATE_RECORDED_VD) ) { state->as_vi_acl = a; + state->as_result = ret; + } state->as_recorded |= ACL_STATE_RECORDED; - state->as_result = ret; } if (be_null) op->o_bd = NULL; return ret; @@ -384,6 +422,7 @@ acl_get( Operation *op, Entry *e, AttributeDescription *desc, + struct berval *val, int nmatch, regmatch_t *matches ) { @@ -498,7 +537,7 @@ acl_get( Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] check attr %s\n", *count, attr, 0); #endif - if ( attr == NULL || a->acl_attrs == NULL || + if ( a->acl_attrs == NULL || ad_inlist( desc, a->acl_attrs ) ) { #ifdef NEW_LOGGING @@ -562,6 +601,7 @@ acl_mask( Access *b; #ifdef LDAP_DEBUG char accessmaskbuf[ACCESSMASK_MAXLEN]; + char accessmaskbuf1[ACCESSMASK_MAXLEN]; #endif const char *attr; @@ -594,6 +634,48 @@ acl_mask( accessmask2str( *mask, accessmaskbuf ) ); #endif + /* Is this ACL only for a specific value? */ + if ( a->acl_attrval.bv_len ) { + if ( state && !state->as_vd_acl ) { + state->as_vd_acl = a; + state->as_vd_access = a->acl_access; + state->as_vd_access_count = 1; + } + if ( val == NULL ) { + return ACL_BREAK; + } + if ( a->acl_attrval_style == ACL_STYLE_REGEX ) { +#ifdef NEW_LOGGING + LDAP_LOG( ACL, DETAIL1, + "acl_get: valpat %s\n", + a->acl_attrval.bv_val, 0, 0 ); +#else + Debug( LDAP_DEBUG_ACL, + "acl_get: valpat %s\n", + a->acl_attrval.bv_val, 0, 0 ); +#endif + if (regexec(&a->acl_attrval_re, val->bv_val, 0, NULL, 0)) + return ACL_BREAK; + } else { + int match = 0; + const char *text; +#ifdef NEW_LOGGING + LDAP_LOG( ACL, DETAIL1, + "acl_get: val %s\n", + a->acl_attrval.bv_val, 0, 0 ); +#else + Debug( LDAP_DEBUG_ACL, + "acl_get: val %s\n", + a->acl_attrval.bv_val, 0, 0 ); +#endif + if (value_match( &match, desc, + desc->ad_type->sat_equality, 0, + val, &a->acl_attrval, &text ) != LDAP_SUCCESS || + match ) + return ACL_BREAK; + } + } + if( state && ( state->as_recorded & ACL_STATE_RECORDED_VD ) && state->as_vd_acl == a ) { @@ -670,7 +752,7 @@ acl_mask( string_expand(&bv, &b->a_dn_pat, e->e_ndn, matches); - if ( dnNormalize2(NULL, &bv, &pat) != LDAP_SUCCESS ) { + if ( dnNormalize(0, NULL, NULL, &bv, &pat, op->o_tmpmemctx ) != LDAP_SUCCESS ) { /* did not expand to a valid dn */ continue; } @@ -903,7 +985,7 @@ dn_match_cleanup:; SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH | SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH, at->a_nvals, - &bv ) == 0 ) + &bv, op->o_tmpmemctx ) == 0 ) { /* found it */ match = 1; @@ -975,7 +1057,7 @@ dn_match_cleanup:; bv.bv_val = buf; string_expand( &bv, &b->a_group_pat, e->e_ndn, matches ); - if ( dnNormalize2( NULL, &bv, &ndn ) != LDAP_SUCCESS ) { + if ( dnNormalize( 0, NULL, NULL, &bv, &ndn, op->o_tmpmemctx ) != LDAP_SUCCESS ) { /* did not expand to a valid dn */ continue; } @@ -1078,6 +1160,9 @@ dn_match_cleanup:; if ( b->a_aci_at != NULL ) { Attribute *at; slap_access_t grant, deny, tgrant, tdeny; + struct berval parent_ndn, old_parent_ndn; + BerVarray bvals = NULL; + int ret,stop; /* this case works different from the others above. * since aci's themselves give permissions, we need @@ -1095,34 +1180,90 @@ dn_match_cleanup:; if ( ! ACL_GRANT( b->a_access_mask, *mask ) ) { continue; } - - /* get the aci attribute */ - at = attr_find( e->e_attrs, b->a_aci_at ); - if ( at == NULL ) { - continue; - } - - ACL_RECORD_VALUE_STATE; - /* start out with nothing granted, nothing denied */ ACL_INIT(tgrant); ACL_INIT(tdeny); - /* the aci is an multi-valued attribute. The - * rights are determined by OR'ing the individual - * rights given by the acis. + /* get the aci attribute */ + at = attr_find( e->e_attrs, b->a_aci_at ); + if ( at != NULL ) { + ACL_RECORD_VALUE_STATE; + /* the aci is an multi-valued attribute. The + * rights are determined by OR'ing the individual + * rights given by the acis. + */ + for ( i = 0; at->a_vals[i].bv_val != NULL; i++ ) { + if (aci_mask( op, + e, desc, val, + &at->a_nvals[i], + matches, &grant, &deny, &aci_bv_entry ) != 0) + { + tgrant |= grant; + tdeny |= deny; + } + } + Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n", + accessmask2str(tgrant,accessmaskbuf), + accessmask2str(tdeny, accessmaskbuf1), 0); + + } + /* If the entry level aci didn't contain anything valid for the + * current operation, climb up the tree and evaluate the + * acis with scope set to subtree */ - for ( i = 0; at->a_vals[i].bv_val != NULL; i++ ) { - if (aci_mask( op, - e, desc, val, - &at->a_nvals[i], - matches, &grant, &deny ) != 0) - { - tgrant |= grant; - tdeny |= deny; + if( (tgrant == ACL_PRIV_NONE) && (tdeny == ACL_PRIV_NONE) ){ + dnParent(&(e->e_nname), &parent_ndn); + while ( parent_ndn.bv_val != old_parent_ndn.bv_val ){ + old_parent_ndn = parent_ndn; + Debug(LDAP_DEBUG_ACL, "checking ACI of %s\n", parent_ndn.bv_val, 0, 0); + ret=backend_attribute(op, NULL, &parent_ndn, b->a_aci_at, &bvals); + switch(ret){ + case LDAP_SUCCESS : + if(bvals){ + for( i = 0; bvals[i].bv_val != NULL; i++){ + ACL_RECORD_VALUE_STATE; + if (aci_mask(op, e, desc, val, &bvals[i], matches, + &grant, &deny, &aci_bv_children) != 0) { + tgrant |= grant; + tdeny |= deny; + /* evaluation stops as soon as either a "deny" or a + * "grant" directive matches. + */ + if( (tgrant != ACL_PRIV_NONE) || (tdeny != ACL_PRIV_NONE) ){ + stop=1; + } + } + Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n", + accessmask2str(tgrant,accessmaskbuf), + accessmask2str(tdeny, accessmaskbuf1), 0); + } + } + stop=0; + break; + case LDAP_NO_SUCH_ATTRIBUTE: + /* just go on if the aci-Attribute is not present in + * the current entry + */ + Debug(LDAP_DEBUG_ACL, "no such attribute\n", 0, 0, 0); + stop=0; + break; + case LDAP_NO_SUCH_OBJECT: + /* We have reached the base object */ + Debug(LDAP_DEBUG_ACL, "no such object\n", 0, 0, 0); + stop=1; + break; + default: + stop=1; + break; + } + if(stop){ + break; + } + dnParent(&old_parent_ndn, &parent_ndn); } } + /* remove anything that the ACL clause does not allow */ tgrant &= b->a_access_mask & ACL_PRIV_MASK; tdeny &= ACL_PRIV_MASK; @@ -1424,9 +1565,9 @@ aci_get_part( } BerVarray -aci_set_gather (void *cookie, struct berval *name, struct berval *attr) +aci_set_gather (SetCookie *cookie, struct berval *name, struct berval *attr) { - AciSetCookie *cp = cookie; + AciSetCookie *cp = (AciSetCookie *)cookie; BerVarray bvals = NULL; struct berval ndn; @@ -1435,14 +1576,14 @@ aci_set_gather (void *cookie, struct berval *name, struct berval *attr) * also return the syntax or some "comparison cookie". */ - if (dnNormalize2(NULL, name, &ndn) == LDAP_SUCCESS) { + if (dnNormalize(0, NULL, NULL, name, &ndn, cp->op->o_tmpmemctx) == LDAP_SUCCESS) { const char *text; AttributeDescription *desc = NULL; if (slap_bv2ad(attr, &desc, &text) == LDAP_SUCCESS) { backend_attribute(cp->op, cp->e, &ndn, desc, &bvals); } - free(ndn.bv_val); + sl_free(ndn.bv_val, cp->op->o_tmpmemctx); } return(bvals); } @@ -1460,7 +1601,7 @@ aci_match_set ( AciSetCookie cookie; if (setref == 0) { - ber_dupbv( &set, subj ); + ber_dupbv_x( &set, subj, op->o_tmpmemctx ); } else { struct berval subjdn, ndn = { 0, NULL }; struct berval setat; @@ -1480,10 +1621,10 @@ aci_match_set ( if ( setat.bv_val != NULL ) { /* - * NOTE: dnNormalize2 honors the ber_len field + * NOTE: dnNormalize honors the ber_len field * as the length of the dn to be normalized */ - if ( dnNormalize2(NULL, &subjdn, &ndn) == LDAP_SUCCESS + if ( dnNormalize(0, NULL, NULL, &subjdn, &ndn, op->o_tmpmemctx) == LDAP_SUCCESS && slap_bv2ad(&setat, &desc, &text) == LDAP_SUCCESS ) { backend_attribute(op, e, @@ -1497,7 +1638,7 @@ aci_match_set ( bvals[0].bv_val = bvals[i-1].bv_val; bvals[i-1].bv_val = NULL; } - ber_bvarray_free(bvals); + ber_bvarray_free_x(bvals, op->o_tmpmemctx); } } if (ndn.bv_val) @@ -1508,9 +1649,9 @@ aci_match_set ( if (set.bv_val != NULL) { cookie.op = op; cookie.e = e; - rc = (slap_set_filter(aci_set_gather, &cookie, &set, + rc = (slap_set_filter(aci_set_gather, (SetCookie *)&cookie, &set, &op->o_ndn, &e->e_nname, NULL) > 0); - ch_free(set.bv_val); + sl_free(set.bv_val, op->o_tmpmemctx); } return(rc); } @@ -1717,7 +1858,7 @@ aci_group_member ( bv.bv_len = sizeof( buf ) - 1; bv.bv_val = (char *)&buf; string_expand(&bv, &subjdn, e->e_ndn, matches); - if ( dnNormalize2(NULL, &bv, &ndn) == LDAP_SUCCESS ) { + if ( dnNormalize(0, NULL, NULL, &bv, &ndn, op->o_tmpmemctx) == LDAP_SUCCESS ) { rc = (backend_group(op, e, &ndn, &op->o_ndn, grp_oc, grp_ad) == 0); free( ndn.bv_val ); @@ -1737,7 +1878,8 @@ aci_mask( struct berval *aci, regmatch_t *matches, slap_access_t *grant, - slap_access_t *deny + slap_access_t *deny, + struct berval *scope ) { struct berval bv, perms, sdn; @@ -1756,7 +1898,6 @@ aci_mask( For now, this routine only supports scope=entry. */ - /* check that the aci has all 5 components */ if (aci_get_part(aci, 4, '#', NULL) < 0) return(0); @@ -1765,9 +1906,9 @@ aci_mask( if (aci_get_part(aci, 0, '#', &bv) < 0) return(0); - /* check that the scope is "entry" */ + /* check that the scope matches */ if (aci_get_part(aci, 1, '#', &bv) < 0 - || ber_bvstrcasecmp( &aci_bv_entry, &bv ) != 0) + || ber_bvstrcasecmp( scope, &bv ) != 0) { return(0); } @@ -1790,7 +1931,7 @@ aci_mask( if (ber_bvstrcasecmp( &aci_bv_access_id, &bv ) == 0) { struct berval ndn; rc = 0; - if ( dnNormalize2(NULL, &sdn, &ndn) == LDAP_SUCCESS ) { + if ( dnNormalize(0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx) == LDAP_SUCCESS ) { if (dn_match( &op->o_ndn, &ndn)) rc = 1; free(ndn.bv_val); @@ -1827,7 +1968,7 @@ aci_mask( SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH | SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH, at->a_nvals, - &bv) == 0 ) + &bv, op->o_tmpmemctx) == 0 ) { rc = 1; break;