← Back to branch summary

~ubuntu-branches/ubuntu/wily/389-ds-base/wily-proposed

« back to all changes in this revision

Viewing changes to ldap/servers/plugins/acl/acl.c

  • Committer: Package Import Robot
  • Author(s): Timo Aaltonen
  • Date: 2014-07-08 15:50:11 UTC
  • mto: (19.1.1 experimental) (0.3.1)
  • mto: This revision was merged to the branch mainline in revision 11.
  • Revision ID: package-import@ubuntu.com-20140708155011-48naeyka2x89ew8g
Tags: upstream-1.3.2.19
Import upstream version 1.3.2.19

Show diffs side-by-side

added added

removed removed

Lines of Context:
ldap/servers/plugins/acl/acl.c
549
549
        ** Check if we can use any cached information to determine 
550
550
        ** access to this resource
551
551
        */
552
 
        if (  (access & SLAPI_ACL_SEARCH) &&
553
 
         (ret_val =  acl__match_handlesFromCache ( aclpb , attr, access))  != -1) {
 
552
        if ((access & SLAPI_ACL_SEARCH) &&
 
553
            (ret_val = acl__match_handlesFromCache(aclpb, attr, access)) != -1) {
554
554
                /* means got a result: allowed or not*/
555
555
 
556
556
                if (ret_val == LDAP_SUCCESS ) {
557
 
                                decision_reason.reason = ACL_REASON_EVALCONTEXT_CACHED_ALLOW;
 
557
                        decision_reason.reason = ACL_REASON_EVALCONTEXT_CACHED_ALLOW;
558
558
                } else if (ret_val == LDAP_INSUFFICIENT_ACCESS) {
559
 
                                decision_reason.reason =
560
 
                                        ACL_REASON_EVALCONTEXT_CACHED_NOT_ALLOWED;
 
559
                        decision_reason.reason = ACL_REASON_EVALCONTEXT_CACHED_NOT_ALLOWED;
561
560
                }
562
561
                goto cleanup_and_ret;
563
562
        }
1058
1057
                                slapi_ch_free ( (void **) &aclpb->aclpb_Evalattr);
1059
1058
                                aclpb->aclpb_Evalattr = slapi_ch_malloc(len+1);
1060
1059
                        }
1061
 
                        PL_strncpyz (aclpb->aclpb_Evalattr, attr_type, len);
 
1060
                        /* length needs to have 1 for '\0' */
 
1061
                        PL_strncpyz (aclpb->aclpb_Evalattr, attr_type, len+1);
1062
1062
#ifdef DETERMINE_ACCESS_BASED_ON_REQUESTED_ATTRIBUTES
1063
1063
                        if ( attr_index >= 0 ) {
1064
1064
                                /*
1191
1191
        }
1192
1192
        
1193
1193
        /*
1194
 
         * Am I a anonymous dude ? then we can use our anonympous profile
 
1194
         * Am I anonymous? then we can use our anonympous profile
1195
1195
         * We don't require the aclpb to have been initialized for anom stuff
1196
 
         *
1197
 
        */
 
1196
         */
1198
1197
        slapi_pblock_get (pb, SLAPI_REQUESTOR_DN ,&clientDn );
1199
 
        if ( clientDn && *clientDn == '\0' ) {          
1200
 
                ret_val =  aclanom_match_profile ( pb, aclpb, e, attr, 
1201
 
                                                SLAPI_ACL_READ );
 
1198
        if (clientDn && (*clientDn == '\0')) {
 
1199
                ret_val = aclanom_match_profile (pb, aclpb, e, attr, SLAPI_ACL_READ);
1202
1200
                TNF_PROBE_1_DEBUG(acl_read_access_allowed_on_attr_end ,"ACL","",
1203
 
                                                        tnf_string,anon_decision,"");
1204
 
                if (ret_val != -1 ) return ret_val;
 
1201
                                  tnf_string,anon_decision,"");
 
1202
                if (ret_val != -1) {
 
1203
                        return ret_val;
 
1204
                }
1205
1205
        }
1206
1206
 
1207
1207
        /* Then I must have a access to the entry. */
1208
1208
        aclpb->aclpb_state |= ACLPB_ACCESS_ALLOWED_ON_ENTRY;
1209
1209
 
1210
 
        if ( aclpb->aclpb_state & ACLPB_MATCHES_ALL_ACLS ) {            
 
1210
        if (aclpb->aclpb_state & ACLPB_MATCHES_ALL_ACLS) {
1211
1211
 
1212
1212
                ret_val = acl__attr_cached_result (aclpb, attr, SLAPI_ACL_READ);
1213
 
                if (ret_val != -1 ) {
 
1213
                if (ret_val != -1) {
1214
1214
                        slapi_log_error(SLAPI_LOG_ACL, plugin_name, 
1215
 
                                 "MATCHED HANDLE:dn:%s attr: %s val:%d\n", 
1216
 
                                n_edn, attr, ret_val );
1217
 
                        if ( ret_val == LDAP_SUCCESS) {
1218
 
                                decision_reason.reason =
1219
 
                                                ACL_REASON_EVALCONTEXT_CACHED_ALLOW;
 
1215
                                        "MATCHED HANDLE:dn:%s attr: %s val:%d\n", 
 
1216
                                        n_edn, attr, ret_val );
 
1217
                        if (ret_val == LDAP_SUCCESS) {
 
1218
                                decision_reason.reason = ACL_REASON_EVALCONTEXT_CACHED_ALLOW;
1220
1219
                        } else {
1221
 
                                decision_reason.reason =
1222
 
                                                        ACL_REASON_EVALCONTEXT_CACHED_NOT_ALLOWED;
1223
 
                        }               
 
1220
                                decision_reason.reason = ACL_REASON_EVALCONTEXT_CACHED_NOT_ALLOWED;
 
1221
                        }
1224
1222
                        goto acl_access_allowed_on_attr_Exit;
1225
 
                 } else  {
 
1223
                } else {
1226
1224
                        aclpb->aclpb_state |= ACLPB_COPY_EVALCONTEXT;
1227
1225
                }
1228
1226
        }
1258
1256
                **  -- access  is allowed on phone
1259
1257
                **  -- Don't know about the rest. Need to evaluate.
1260
1258
                */
1261
 
 
1262
 
                if ( slapi_attr_type_cmp (attr, aclpb->aclpb_Evalattr, 1) == 0) {
 
1259
                if (slapi_attr_type_cmp(aclpb->aclpb_Evalattr, attr, SLAPI_TYPE_CMP_SUBTYPE) == 0) {
1263
1260
                        /* from now on we need to evaluate access on
1264
1261
                        ** rest of the attrs.
1265
1262
                        */
1266
 
                        aclpb->aclpb_state &= ~ACLPB_ACCESS_ALLOWED_ON_A_ATTR;
1267
1263
                        TNF_PROBE_1_DEBUG(acl_read_access_allowed_on_attr_end ,"ACL","",
1268
 
                                                                tnf_string,aclp_Evalattr1,"");
1269
 
 
 
1264
                                          tnf_string,aclp_Evalattr1,"");
1270
1265
                        return LDAP_SUCCESS;
1271
 
                } else {
1272
 
                        /*
1273
 
                         * Here, the attr that implied access to the entry (aclpb_Evalattr),
1274
 
                         *  is not
1275
 
                         * the one we currently want evaluated--so
1276
 
                         * we need to evaluate access to attr--so fall through.
1277
 
                        */                                              
1278
1266
                }
1279
1267
 
1280
 
        }  else if (aclpb->aclpb_state & ACLPB_ACCESS_ALLOWED_USERATTR) {
 
1268
                /*
 
1269
                 * Here, the attr that implied access to the entry (aclpb_Evalattr),
 
1270
                 *  is not
 
1271
                 * the one we currently want evaluated--so
 
1272
                 * we need to evaluate access to attr--so fall through.
 
1273
                 */
 
1274
 
 
1275
        } else if (aclpb->aclpb_state & ACLPB_ACCESS_ALLOWED_USERATTR) {
1281
1276
                /* Only skip evaluation on the user attr on which we have
1282
1277
                ** evaluated before.
1283
1278
                */
1284
 
                if ( slapi_attr_type_cmp (attr, aclpb->aclpb_Evalattr, 1) == 0) {
 
1279
                if (slapi_attr_type_cmp(aclpb->aclpb_Evalattr, attr, SLAPI_TYPE_CMP_SUBTYPE) == 0) {
1285
1280
                        aclpb->aclpb_state &= ~ACLPB_ACCESS_ALLOWED_USERATTR;
1286
1281
                        TNF_PROBE_1_DEBUG(acl_read_access_allowed_on_attr_end ,"ACL","",
1287
 
                                                                tnf_string,aclp_Evalattr2,"");
 
1282
                                          tnf_string,aclp_Evalattr2,"");
1288
1283
                        return LDAP_SUCCESS;
1289
1284
                }
1290
1285
        }
1291
1286
 
1292
1287
        /* we need to evaluate the access on this attr */
 
1288
        /*
 
1289
         * targetattr=sn;en
 
1290
         * search attribute list: cn sn
 
1291
         * ==>
 
1292
         * attr: cn sn;en
 
1293
         * aclpb_Evalattr: sn;en
 
1294
         */
1293
1295
        return ( acl_access_allowed(pb, e, attr, val, access) );
1294
1296
 
1295
1297
        /* This exit point prints a summary and returns ret_val */
1296
1298
acl_access_allowed_on_attr_Exit:
1297
1299
 
1298
 
        /* print summary if loglevel set */                     
 
1300
        /* print summary if loglevel set */
1299
1301
        if ( slapi_is_loglevel_set(loglevel) ) {
1300
1302
                
1301
1303
                print_access_control_summary( "on attr",
1302
1304
                                                                                ret_val, clientDn, aclpb,
1303
1305
                                                                                acl_access2str(SLAPI_ACL_READ),
1304
 
                                                                                attr, n_edn,                                                                                    &decision_reason);
 
1306
                                                                                attr, n_edn, &decision_reason);
1305
1307
        }
1306
1308
        TNF_PROBE_0_DEBUG(acl_read_access_allowed_on_attr_end ,"ACL","");
1307
1309
 
1697
1699
 
1698
1700
                mods = (LDAPMod **) change;
1699
1701
                
1700
 
                for (j=0;  mods[j] != NULL; j++) {
1701
 
                        if (strcasecmp(mods[j]->mod_type, aci_attr_type) == 0) {
 
1702
                for (j=0; mods && mods[j]; j++) {
 
1703
                        if (slapi_attr_type_cmp(mods[j]->mod_type, aci_attr_type,
 
1704
                                                SLAPI_TYPE_CMP_SUBTYPE) == 0) {
1702
1705
 
1703
1706
                                /* Got an aci to mod in this list of mods, so
1704
1707
                                 * take the acicache lock for the whole list of mods,
2165
2168
                } else {
2166
2169
                        dn_matched = ACL_TRUE;
2167
2170
                }
2168
 
                                                                                                                
 
2171
 
2169
2172
                if (aci->aci_type & ACI_TARGET_NOT) {
2170
2173
                        matches = (dn_matched ? ACL_FALSE : ACL_TRUE);
2171
2174
                } else {
2347
2350
                                         * of the attribute in the entry--otherwise you
2348
2351
                                         * could satisfy the filter and then put loads of other
2349
2352
                                         * values in on the back of it.
2350
 
                                        */
 
2353
                                         */
2351
2354
 
2352
2355
                                        sval=NULL;
2353
2356
                                        attrVal=NULL;
2356
2359
                                        while(k != -1 && !done) {
2357
2360
                                                attrVal = slapi_value_get_berval(sval);
2358
2361
 
2359
 
                                                if ( acl__make_filter_test_entry(
2360
 
                                &aclpb->aclpb_filter_test_entry,
2361
 
                                                                attrFilter->attr_str,
2362
 
                                                                (struct berval *)attrVal) == LDAP_SUCCESS ) {                      
2363
 
                                
2364
 
                                                        attr_matched= acl__test_filter( 
2365
 
                                        aclpb->aclpb_filter_test_entry,
2366
 
                                                                                attrFilter->filter,
2367
 
                                                                                1 /* Do filter sense evaluation below */
2368
 
                                                                                );
 
2362
                                                if (acl__make_filter_test_entry(&aclpb->aclpb_filter_test_entry,
 
2363
                                                                                attrFilter->attr_str,
 
2364
                                                                                (struct berval *)attrVal) == LDAP_SUCCESS ) {
 
2365
 
 
2366
                                                        attr_matched = acl__test_filter(aclpb->aclpb_filter_test_entry,
 
2367
                                                                                        attrFilter->filter,
 
2368
                                                                                        1 /* Do filter sense evaluation below */
 
2369
                                                                                       );
2369
2370
                                                        done = !attr_matched;
2370
 
                                                        slapi_entry_free( aclpb->aclpb_filter_test_entry );                     
 
2371
                                                        slapi_entry_free( aclpb->aclpb_filter_test_entry );
2371
2372
                                                }                                           
2372
2373
                                                
2373
2374
                                                k= slapi_attr_next_value(attr_ptr, k, &sval);
2379
2380
                                         * of the attribute in the entry satisfied the filter.
2380
2381
                                         * Otherwise, attr_matched is ACL_FALSE and not every 
2381
2382
                                         * value satisfied the filter, so we will teminate the
2382
 
                                         * scan of the filter list.                                     
2383
 
                                        */
 
2383
                                         * scan of the filter list.
 
2384
                                         */
2384
2385
 
2385
2386
                                }
2386
2387
 
2391
2392
                 * Here, we've applied all the applicable filters to the entry.
2392
2393
                 * Each one must have been satisfied by all the values of the attribute.
2393
2394
                 * The result of this is stored in attr_matched.
2394
 
                */              
 
2395
                 */
2395
2396
 
2396
 
#if 0           
 
2397
#if 0
2397
2398
                /*
2398
2399
                 * Don't support a notion of "add != " or "del != "
2399
2400
                 * at the moment.
2415
2416
                        goto acl__resource_match_aci_EXIT;      
2416
2417
                }
2417
2418
 
2418
 
        } else  if ( ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_ADD) &&
2419
 
                  (aci->aci_type & ACI_TARGET_ATTR_ADD_FILTERS)) ||
2420
 
                 ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_DEL) &&
2421
 
                  (aci->aci_type & ACI_TARGET_ATTR_DEL_FILTERS)) ) {
2422
 
 
2423
 
            
 
2419
        } else if ( ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_ADD) &&
 
2420
                 (aci->aci_type & ACI_TARGET_ATTR_ADD_FILTERS)) ||
 
2421
                ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_DEL) &&
 
2422
                 (aci->aci_type & ACI_TARGET_ATTR_DEL_FILTERS)) ) {
2424
2423
                /*     
2425
2424
                 * Here, it's a modify add/del and we have attr filters.  
2426
2425
                 * So, we need to scan the add/del filter list to find the filter
2436
2435
                int found = 0;
2437
2436
 
2438
2437
                if ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_ADD) &&
2439
 
                        (aci->aci_type & ACI_TARGET_ATTR_ADD_FILTERS)) {
2440
 
 
 
2438
                    (aci->aci_type & ACI_TARGET_ATTR_ADD_FILTERS)) {
2441
2439
                        attrFilterArray = aci->targetAttrAddFilters;
2442
 
 
2443
2440
                } else if ((aclpb->aclpb_access & ACLPB_SLAPI_ACL_WRITE_DEL) && 
2444
 
                                   (aci->aci_type & ACI_TARGET_ATTR_DEL_FILTERS)) {
2445
 
                                
 
2441
                           (aci->aci_type & ACI_TARGET_ATTR_DEL_FILTERS)) {
2446
2442
                        attrFilterArray = aci->targetAttrDelFilters;
2447
 
 
2448
2443
                }
2449
2444
                
2450
2445
 
2456
2451
                num_attrs = 0;
2457
2452
 
2458
2453
                while (attrFilterArray[num_attrs] && !found) {
2459
 
                                attrFilter = attrFilterArray[num_attrs];
 
2454
                        attrFilter = attrFilterArray[num_attrs];
2460
2455
 
2461
2456
                        /* If this filter applies to the attribute, stop. */
2462
2457
                        if ((aclpb->aclpb_curr_attrEval) &&
2463
 
                                slapi_attr_type_cmp ( aclpb->aclpb_curr_attrEval->attrEval_name,
2464
 
                                                                          attrFilter->attr_str, 1) == 0) {
 
2458
                                slapi_attr_type_cmp(aclpb->aclpb_curr_attrEval->attrEval_name,
 
2459
                                                    attrFilter->attr_str, SLAPI_TYPE_CMP_SUBTYPE) == 0) {
2465
2460
                                found = 1;
2466
2461
                        }
2467
2462
                        num_attrs++;
2475
2470
 
2476
2471
                if (found) {
2477
2472
 
2478
 
                        if ( acl__make_filter_test_entry(
2479
 
                                &aclpb->aclpb_filter_test_entry,
2480
 
                                                                aclpb->aclpb_curr_attrEval->attrEval_name,
2481
 
                                                                aclpb->aclpb_curr_attrVal) == LDAP_SUCCESS ) {                      
 
2473
                        if (acl__make_filter_test_entry(&aclpb->aclpb_filter_test_entry,
 
2474
                                                        aclpb->aclpb_curr_attrEval->attrEval_name,
 
2475
                                                        aclpb->aclpb_curr_attrVal) == LDAP_SUCCESS ) {
2482
2476
                                
2483
2477
                                attr_matched= acl__test_filter(aclpb->aclpb_filter_test_entry,
2484
2478
                                                                                attrFilter->filter,
2485
2479
                                                                                1 /* Do filter sense evaluation below */
2486
 
                                                                                );                            
2487
 
                                slapi_entry_free( aclpb->aclpb_filter_test_entry );                     
2488
 
                        }           
 
2480
                                                                                );
 
2481
                                slapi_entry_free( aclpb->aclpb_filter_test_entry );
 
2482
                        }
2489
2483
 
2490
2484
                        /* No need to look further */
2491
2485
                        if (attr_matched == ACL_FALSE) {
2500
2494
                        */
2501
2495
                
2502
2496
                        attr_matched_in_targetattrfilters = 1;
2503
 
                }                                
 
2497
                }
2504
2498
        } /* targetvaluefilters */ 
2505
2499
        
2506
2500
 
2572
2566
     * bother to look at the attrlist.
2573
2567
    */
2574
2568
    
2575
 
    if (!attr_matched_in_targetattrfilters) {                
 
2569
    if (!attr_matched_in_targetattrfilters) {
2576
2570
            
2577
2571
        /* match target attr */
2578
2572
        if ((c_attrEval) && 
2587
2581
                        num_attrs = 0;
2588
2582
 
2589
2583
                        while (attrArray[num_attrs] && !attr_matched) {
2590
 
                                attr = attrArray[num_attrs];           
2591
 
                    if (attr->attr_type & ACL_ATTR_STRING) { 
2592
 
                                        if (slapi_attr_type_cmp ( res_attr, 
2593
 
                                                        attr->u.attr_str, 1) == 0) {
 
2584
                                attr = attrArray[num_attrs];
 
2585
                                if (attr->attr_type & ACL_ATTR_STRING) { 
 
2586
                                        /*
 
2587
                                         * res_attr: attr type to eval (e.g., filter "(sn;en=*)")
 
2588
                                         * attr->u.attr_str: targetattr value (e.g., sn;en)
 
2589
                                         */
 
2590
                                        if (slapi_attr_type_cmp(attr->u.attr_str, res_attr, SLAPI_TYPE_CMP_SUBTYPE) == 0) {
2594
2591
                                                attr_matched = ACL_TRUE;
2595
2592
                                                *a_matched = ACL_TRUE;
2596
2593
                                        } 
3518
3515
 
3519
3516
                if ( a_eval == NULL ) continue;
3520
3517
 
3521
 
                if (strcasecmp ( attr, a_eval->attrEval_name ) == 0 ) {
 
3518
                if (slapi_attr_type_cmp(a_eval->attrEval_name, attr, SLAPI_TYPE_CMP_SUBTYPE) == 0) {
3522
3519
                        if ( access & SLAPI_ACL_SEARCH ) {
3523
3520
                                if (a_eval->attrEval_s_status < ACL_ATTREVAL_DETERMINISTIC ) {
3524
3521
                                        if ( a_eval->attrEval_s_status & ACL_ATTREVAL_SUCCESS)
3708
3705
                        continue;
3709
3706
 
3710
3707
                for ( j = 0; j < dest->acle_numof_attrs; j++ ) {
3711
 
                        if ( strcasecmp ( src->acle_attrEval[i].attrEval_name,
3712
 
                                          dest->acle_attrEval[j].attrEval_name ) == 0 ) {
 
3708
                        if (slapi_attr_type_cmp(src->acle_attrEval[i].attrEval_name,
 
3709
                                                dest->acle_attrEval[j].attrEval_name,
 
3710
                                                SLAPI_TYPE_CMP_SUBTYPE) == 0) {
3713
3711
                                /* We have it. skip it. */
3714
3712
                                attr_exists = 1;
3715
3713
                                dd_slot = j;
3752
3750
                        (size_t)src->acle_numof_tmatched_handles, sizeof( int ), acl__cmp );
3753
3751
 
3754
3752
        for (i=0; i < src->acle_numof_tmatched_handles; i++ )  {
3755
 
                dest->acle_handles_matched_target[i]  =
3756
 
                                src->acle_handles_matched_target[i];
 
3753
                dest->acle_handles_matched_target[i] = src->acle_handles_matched_target[i];
3757
3754
        }
3758
3755
 
3759
3756
        if ( src->acle_numof_tmatched_handles ) {
3918
3915
        /* Go thru and see if we have the attr already */
3919
3916
        for (j=0; j < c_ContextEval->acle_numof_attrs; j++) {
3920
3917
                c_attrEval = &c_ContextEval->acle_attrEval[j];
3921
 
                        
3922
 
                if ( c_attrEval && 
3923
 
                        slapi_attr_type_cmp ( c_attrEval->attrEval_name, attr, 1) == 0 ) {
 
3918
 
 
3919
                if (c_attrEval && 
 
3920
                    /* attr: e.g., filter "(sn;en=*)" / attr list / attr in entry */
 
3921
                    /* This compare must check all subtypes.  "sn" vs. "sn;fr" should return 1 */
 
3922
                    slapi_attr_type_cmp(c_attrEval->attrEval_name,
 
3923
                                        attr, SLAPI_TYPE_CMP_SUBTYPES) == 0) {
3924
3924
                        aclpb->aclpb_curr_attrEval = c_attrEval;
3925
3925
                        break;
3926
3926
                }