allow "expand" style in peername, sockname, sockurl as well; more sanity checks

diff --git a/doc/man/man5/slapd.access.5 b/doc/man/man5/slapd.access.5
index ab76f6de59ef527641f46681b93cc9f166e987d1..ac3468491270f052e867ca02d880cf3604371b53 100644 (file)
--- a/doc/man/man5/slapd.access.5
+++ b/doc/man/man5/slapd.access.5
@@ -189,7 +189,7 @@ It can have the forms
        sockname[.<style>]=<sockname>
        domain[.<domainstyle>[,<modifier>]]=<domain>
        sockurl[.<style>]=<sockurl>
-       set[.<style>]=<pattern>
+       set[.<setstyle>]=<pattern>
 
        ssf=<n>
        transport_ssf=<n>
@@ -204,9 +204,10 @@ with
 .nf
        <dnstyle>={{exact|base}|regex|sub(tree)|one(level)|children}
        <groupstyle>={exact|expand}
-       <style>={exact|regex}
-       <peernamestyle>={exact|regex|ip|path}
+       <style>={exact|regex|expand}
+       <peernamestyle>={<style>|ip|path}
        <domainstyle>={exact|regex|sub(tree)}
+       <setstyle>={exact|regex}
        <modifier>={expand}
 .fi
 .LP
@@ -331,7 +332,13 @@ The same
 .B style
 rules for pattern match described for the
 .B group
-case apply. 
+case apply, plus the
+.B regex
+style, which implies submatch
+.B expand
+and
+.BR regex (7)
+match of the corresponding connection parameters.
 The
 .B exact
 style of the
@@ -395,6 +402,13 @@ pattern, or its trailing part, after a
 exactly matches the 
 .BR domain
 pattern.
+The 
+.B expand
+style is allowed, implying an
+.B exact 
+match with submatch expansion; the use of 
+.B expand 
+as a style modifier is considered more appropriate.
 As an example,
 .B domain.subtree=example.com
 will match www.example.com, but will not match www.anotherexample.com.

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index 452cb732f03563bcbdf4c9ffedde6c57db7425e1..dccaeded050c2943d71a7225399c83657a73afdc 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -908,6 +908,19 @@ dn_match_cleanup:;
                                        {
                                                continue;
                                        }
+
+                               } else if ( b->a_sockurl_style == ACL_STYLE_EXPAND ) {
+                                       struct berval   bv;
+                                       char buf[ACL_BUF_SIZE];
+
+                                       bv.bv_len = sizeof( buf ) - 1;
+                                       bv.bv_val = buf;
+                                       string_expand( &bv, &b->a_sockurl_pat, e->e_ndn, matches );
+
+                                       if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_listener_url ) != 0 ) {
+                                               continue;
+                                       }
+
                                } else {
                                        if ( ber_bvstrcasecmp( &b->a_sockurl_pat, &op->o_conn->c_listener_url ) != 0 )
                                                continue;
@@ -985,7 +998,7 @@ dn_match_cleanup:;
                                b->a_peername_pat.bv_val, 0, 0 );
 #endif
                        if ( !ber_bvccmp( &b->a_peername_pat, '*' ) ) {
-                               if ( b->a_peername_style == ACL_STYLE_REGEX) {
+                               if ( b->a_peername_style == ACL_STYLE_REGEX ) {
                                        if (!regex_matches( &b->a_peername_pat, op->o_conn->c_peer_name.bv_val,
                                                        e->e_ndn, matches ) ) 
                                        {
@@ -995,8 +1008,21 @@ dn_match_cleanup:;
                                } else {
                                        /* try exact match */
                                        if ( b->a_peername_style == ACL_STYLE_BASE ) {
-                                               if ( ber_bvstrcasecmp( &b->a_peername_pat, &op->o_conn->c_peer_name ) != 0 )
+                                               if ( ber_bvstrcasecmp( &b->a_peername_pat, &op->o_conn->c_peer_name ) != 0 ) {
                                                        continue;
+                                               }
+
+                                       } else if ( b->a_peername_style == ACL_STYLE_EXPAND ) {
+                                               struct berval   bv;
+                                               char buf[ACL_BUF_SIZE];
+
+                                               bv.bv_len = sizeof( buf ) - 1;
+                                               bv.bv_val = buf;
+                                               string_expand( &bv, &b->a_peername_pat, e->e_ndn, matches );
+
+                                               if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_peer_name ) != 0 ) {
+                                                       continue;
+                                               }
 
                                        /* extract IP and try exact match */
                                        } else if ( b->a_peername_style == ACL_STYLE_IP ) {
@@ -1088,6 +1114,19 @@ dn_match_cleanup:;
                                        {
                                                continue;
                                        }
+
+                               } else if ( b->a_sockname_style == ACL_STYLE_EXPAND ) {
+                                       struct berval   bv;
+                                       char buf[ACL_BUF_SIZE];
+
+                                       bv.bv_len = sizeof( buf ) - 1;
+                                       bv.bv_val = buf;
+                                       string_expand( &bv, &b->a_sockname_pat, e->e_ndn, matches );
+
+                                       if ( ber_bvstrcasecmp( &bv, &op->o_conn->c_sock_name ) != 0 ) {
+                                               continue;
+                                       }
+
                                } else {
                                        if ( ber_bvstrcasecmp( &b->a_sockname_pat, &op->o_conn->c_sock_name ) != 0 )
                                                continue;

diff --git a/servers/slapd/aclparse.c b/servers/slapd/aclparse.c
index fa704fa3257b2465072e6fca2cfa75f75c485ce9..61dda94b37ae62207041095f3b78e03cd26ec6a3 100644 (file)
--- a/servers/slapd/aclparse.c
+++ b/servers/slapd/aclparse.c
@@ -469,13 +469,15 @@ parse_acl(
                                                break;
 
                                        default:
+                                               /* we'll see later if it's pertinent */
                                                expand = 1;
                                                break;
                                        }
                                }
 
+                               /* expand in <who> needs regex in <what> */
                                if ( ( sty == ACL_STYLE_EXPAND || expand )
-                                               && ( a->acl_dn_pat.bv_len && a->acl_dn_style != ACL_STYLE_REGEX) ) 
+                                               && a->acl_dn_style != ACL_STYLE_REGEX )
                                {
                                        fprintf( stderr, "%s: line %d: "
                                                "\"expand\" style or modifier used "
@@ -644,7 +646,7 @@ parse_acl(
 
                                        switch ( sty ) {
                                        case ACL_STYLE_REGEX:
-                                               /* legacy */
+                                               /* legacy, tolerated */
                                                fprintf( stderr, "%s: line %d: "
                                                        "deprecated group style \"regex\"; "
                                                        "use \"expand\" instead\n",
@@ -652,13 +654,14 @@ parse_acl(
                                                sty = ACL_STYLE_EXPAND;
                                                break;
 
-                                       case ACL_STYLE_EXPAND:
                                        case ACL_STYLE_BASE:
-                                               /* legal */
+                                               /* legal, traditional */
+                                       case ACL_STYLE_EXPAND:
+                                               /* legal, substring expansion; supersedes regex */
                                                break;
 
                                        default:
-                                               /* unhandled */
+                                               /* unknown */
                                                fprintf( stderr, "%s: line %d: "
                                                        "inappropriate style \"%s\" in by clause\n",
                                                        fname, lineno, style );
@@ -814,8 +817,12 @@ parse_acl(
                                        switch (sty) {
                                        case ACL_STYLE_REGEX:
                                        case ACL_STYLE_BASE:
+                                               /* legal, traditional */
+                                       case ACL_STYLE_EXPAND:
+                                               /* cheap replacement to regex for simple expansion */
                                        case ACL_STYLE_IP:
                                        case ACL_STYLE_PATH:
+                                               /* legal, peername specific */
                                                break;
 
                                        default:
@@ -899,7 +906,16 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "sockname" ) == 0 ) {
-                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
+                                       switch (sty) {
+                                       case ACL_STYLE_REGEX:
+                                       case ACL_STYLE_BASE:
+                                               /* legal, traditional */
+                                       case ACL_STYLE_EXPAND:
+                                               /* cheap replacement to regex for simple expansion */
+                                               break;
+
+                                       default:
+                                               /* unknown */
                                                fprintf( stderr, "%s: line %d: "
                                                        "inappropriate style \"%s\" in by clause\n",
                                                    fname, lineno, style );
@@ -939,9 +955,23 @@ parse_acl(
                                        case ACL_STYLE_REGEX:
                                        case ACL_STYLE_BASE:
                                        case ACL_STYLE_SUBTREE:
+                                               /* legal, traditional */
+                                               break;
+
+                                       case ACL_STYLE_EXPAND:
+                                               /* tolerated: means exact,expand */
+                                               if ( expand ) {
+                                                       fprintf( stderr,
+                                                               "%s: line %d: "
+                                                               "\"expand\" modifier with \"expand\" style\n",
+                                                               fname, lineno );
+                                               }
+                                               sty = ACL_STYLE_BASE;
+                                               expand = 1;
                                                break;
 
                                        default:
+                                               /* unknown */
                                                fprintf( stderr,
                                                        "%s: line %d: inappropriate style \"%s\" in by clause\n",
                                                    fname, lineno, style );
@@ -977,9 +1007,18 @@ parse_acl(
                                }
 
                                if ( strcasecmp( left, "sockurl" ) == 0 ) {
-                                       if (sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE) {
-                                               fprintf( stderr,
-                                                       "%s: line %d: inappropriate style \"%s\" in by clause\n",
+                                       switch (sty) {
+                                       case ACL_STYLE_REGEX:
+                                       case ACL_STYLE_BASE:
+                                               /* legal, traditional */
+                                       case ACL_STYLE_EXPAND:
+                                               /* cheap replacement to regex for simple expansion */
+                                               break;
+
+                                       default:
+                                               /* unknown */
+                                               fprintf( stderr, "%s: line %d: "
+                                                       "inappropriate style \"%s\" in by clause\n",
                                                    fname, lineno, style );
                                                acl_usage();
                                        }