← Back to branch summary

~ubuntu-branches/ubuntu/utopic/389-ds-base/utopic-proposed

« back to all changes in this revision

Viewing changes to ldap/servers/plugins/acl/acllas.c

  • Committer: Package Import Robot
  • Author(s): Timo Aaltonen
  • Date: 2014-02-03 11:08:50 UTC
  • mfrom: (0.2.1)
  • Revision ID: package-import@ubuntu.com-20140203110850-tjzx85elnke9fiu3
Tags: 1.3.2.9-1
http://bugs.debian.org/704077
http://bugs.debian.org/704421
http://bugs.debian.org/718325
http://bugs.debian.org/721222
http://bugs.debian.org/730115
* New upstream release.
  - fixes CVE-2013-0336 (Closes: #704077)
  - fixes CVE-2013-1897 (Closes: #704421)
  - fixes CVE-2013-2219 (Closes: #718325)
  - fixes CVE-2013-4283 (Closes: #721222)
  - fixes CVE-2013-4485 (Closes: #730115)
* Drop fix-CVE-2013-0312.diff, upstream.
* rules: Add new scripts to rename.
* fix-sasl-path.diff: Use a triplet path to find libsasl2. (LP:
  #1088822)
* admin_scripts.diff: Add patch from upstream #47511 to fix bashisms.
* control: Add ldap-utils to -base depends.
* rules, rename-online-scripts.diff: Some scripts with .pl suffix are
  meant for an online server, so instead of overwriting the offline
  scripts use -online suffix.
* rules: Enable parallel build, but limit the jobs to 1 for
  dh_auto_install.
* control: Bump policy to 3.9.5, no changes.
* rules: Add get-orig-source target.
* lintian-overrides: Drop obsolete entries, add comments for the rest.

Show diffs side-by-side

added added

removed removed

Lines of Context:
ldap/servers/plugins/acl/acllas.c
584
584
                } else {
585
585
                        /* URL format */
586
586
                        
587
 
                        if ((strstr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
588
 
                                (strstr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
589
 
                                (strstr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                     
 
587
                        if ((strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
 
588
                                (strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
 
589
                                (strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                 
590
590
                                
591
591
                                matched = aclutil_evaluate_macro( s_user, &lasinfo,
592
592
                                                                                                        ACL_EVAL_USER);
856
856
                                        "Group not evaluated(%s)\n", groupName);
857
857
                        break;
858
858
                } else {                        
859
 
                        if ((strstr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
860
 
                                (strstr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
861
 
                                (strstr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                        
 
859
                        if ((strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
 
860
                                (strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
 
861
                                (strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                    
862
862
                                matched = aclutil_evaluate_macro( groupName, &lasinfo,
863
863
                                                                                                        ACL_EVAL_GROUP);
864
864
                                slapi_log_error ( SLAPI_LOG_ACL, plugin_name,
1075
1075
                } else {
1076
1076
 
1077
1077
                        /* Take care of param strings */
1078
 
                        if ((strstr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
1079
 
                                (strstr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
1080
 
                                (strstr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                     
 
1078
                        if ((strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
 
1079
                                (strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
 
1080
                                (strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                 
1081
1081
                                
1082
1082
                                matched = aclutil_evaluate_macro( role, &lasinfo,
1083
1083
                                                                                                        ACL_EVAL_ROLE);
1684
1684
 
1685
1685
        /* None method means, we don't care -- otherwise we care */
1686
1686
        if ((strcasecmp(attr, "none") == 0) ||
1687
 
                (strcasecmp(attr, lasinfo.authType) == 0)) {
 
1687
                (strcasecmp(attr, lasinfo.authType) == 0) ||
 
1688
                (lasinfo.ldapi && strcasecmp(attr, DS_ATTR_LDAPI) == 0))
 
1689
        {
1688
1690
                matched = ACL_TRUE;
1689
1691
        }
1690
1692
 
2598
2600
 
2599
2601
                /* In this case "grppupdnattr="ldap:///base??attr" */
2600
2602
 
2601
 
                if ((strstr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
2602
 
                        (strstr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
2603
 
                        (strstr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                 
 
2603
                if ((strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
 
2604
                        (strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
 
2605
                        (strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {                     
2604
2606
                                
2605
2607
                                matched = aclutil_evaluate_macro( attrName, &lasinfo,
2606
2608
                                                                                                        ACL_EVAL_GROUPDNATTR);
3678
3680
                aclpb->aclpb_client_entry = slapi_entry_dup ( e );
3679
3681
        return 0;
3680
3682
}
 
3683
 
3681
3684
/*
3682
3685
*
3683
3686
* Do all the necessary setup for all the
3694
3697
*       #define LAS_EVAL_FAIL       -4
3695
3698
*       #define LAS_EVAL_INVALID    -5
3696
3699
*/
3697
 
 
3698
3700
static int
3699
3701
__acllas_setup ( NSErr_t *errp, char *attr_name, CmpOp_t comparator,
3700
3702
                int allow_range, char *attr_pattern, int *cachable, void **LAS_cookie,
3750
3752
                return LAS_EVAL_FAIL;
3751
3753
        }
3752
3754
 
3753
 
        if ((rc = PListFindValue(subject, DS_ATTR_ENTRY, 
3754
 
                                        (void **)&linfo->resourceEntry, NULL)) < 0)     {
 
3755
        if ((rc = PListFindValue(subject, DS_ATTR_ENTRY,
 
3756
                                        (void **)&linfo->resourceEntry, NULL)) < 0){
3755
3757
                acl_print_acllib_err(errp, NULL);
3756
3758
                slapi_log_error( SLAPI_LOG_ACL, plugin_name, 
3757
3759
                          "%s:Unable to get the Slapi_Entry attr(%d)\n",lasName, rc);
3767
3769
                        "%s:Unable to get the ACLPB(%d)\n", lasName, rc);
3768
3770
                return LAS_EVAL_FAIL;
3769
3771
        }
 
3772
 
 
3773
        /* LDAPI? */
 
3774
        if ((rc = PListFindValue(subject, DS_ATTR_LDAPI, (void **)&linfo->ldapi, NULL)) < 0){
 
3775
                slapi_log_error( SLAPI_LOG_ACL, plugin_name,
 
3776
                          "%s:Unable to get LDAPI value(%d)\n", lasName, rc);
 
3777
 
 
3778
                return LAS_EVAL_FAIL;
 
3779
        }
 
3780
 
3770
3781
        if (NULL == attr_pattern ) {
3771
3782
                slapi_log_error( SLAPI_LOG_ACL, plugin_name, 
3772
3783
                          "%s:No rule value in the ACL\n", lasName);
4157
4168
        int has_macro_levels = 0;
4158
4169
        
4159
4170
        /* Determine what the rule's got once */
4160
 
        if ( strstr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
 
4171
        if ( strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
4161
4172
                /* ($dn) exists */
4162
4173
                has_macro_dn = 1;
4163
4174
        }
4164
4175
 
4165
 
        if ( strstr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
 
4176
        if ( strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
4166
4177
                /* [$dn] exists */
4167
4178
                has_macro_levels = 1;
4168
4179
        }
4266
4277
        int l;
4267
4278
        Slapi_Attr *attr = NULL;
4268
4279
        
4269
 
        str = strstr(rule, ACL_RULE_MACRO_ATTR_KEY);
 
4280
        str = strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
4270
4281
        if ( str == NULL ) {
4271
4282
 
4272
4283
                charray_add(&a, slapi_ch_strdup(rule));
4275
4286
        } else {
4276
4287
        
4277
4288
                working_rule = slapi_ch_strdup(rule);
4278
 
                str = strstr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
 
4289
                str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
4279
4290
                charray_add(&working_list, working_rule );
4280
4291
                
4281
4292
                while( str != NULL) {
4373
4384
                        slapi_ch_free_string(&macro_str);
4374
4385
                        slapi_ch_free_string(&macro_attr_name);
4375
4386
                        
4376
 
                        str = strstr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
 
4387
                        str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
4377
4388
                
4378
4389
        }/* while */
4379
4390