From 5a96717edfa061bf797eec36361deeab64a854f4 Mon Sep 17 00:00:00 2001
From: Nathan Kinder <nkinder@redhat.com>
Date: Wed, 11 Sep 2013 18:23:14 -0700
Subject: [PATCH 6/7] Ticket 449 - Allow macro aci keywords to be
case-insensitive
This allows the macro aci keywords ($attr and $dn) to be
case-insensitive. We were allowing the keywords to be set
regardless of case, but we were only processing them properly
if they were lowercase. This patch makes the processing
case-insensitive as well.
I also added validation of the attribute name that is appended
to the $attr keyword. We previously performed no validation. The
patch ensures that the attribute name is legal per RFC 4512, but
we don't check if it is defined in the schema. This will allow an
aci to be set prior to adding the attribute to the schema. It
also allows attributes that are used in an extensibleObject entry
to work properly with macro acis.
(cherry picked from commit a7e9f7b2f4df38d81b1cbf6bc53c79d0d56bc36c)
---
ldap/servers/plugins/acl/acllas.c | 34 +++++++++++++++++-----------------
ldap/servers/plugins/acl/aclparse.c | 34 ++++++++++++++++++++++++++++++----
ldap/servers/plugins/acl/aclutil.c | 6 +++---
3 files changed, 50 insertions(+), 24 deletions(-)
diff --git a/ldap/servers/plugins/acl/acllas.c b/ldap/servers/plugins/acl/acllas.c
index 5bcb482..ee113bc 100644
--- a/ldap/servers/plugins/acl/acllas.c
+++ b/ldap/servers/plugins/acl/acllas.c
@@ -584,9 +584,9 @@ DS_LASUserDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* URL format */
- if ((strstr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (user, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (user, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (user, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( s_user, &lasinfo,
ACL_EVAL_USER);
@@ -856,9 +856,9 @@ DS_LASGroupDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
"Group not evaluated(%s)\n", groupName);
break;
} else {
- if ((strstr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (groupName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (groupName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (groupName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( groupName, &lasinfo,
ACL_EVAL_GROUP);
slapi_log_error ( SLAPI_LOG_ACL, plugin_name,
@@ -1075,9 +1075,9 @@ DS_LASRoleDnEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
} else {
/* Take care of param strings */
- if ((strstr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (role, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (role, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (role, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( role, &lasinfo,
ACL_EVAL_ROLE);
@@ -2598,9 +2598,9 @@ DS_LASGroupDnAttrEval(NSErr_t *errp, char *attr_name, CmpOp_t comparator,
/* In this case "grppupdnattr="ldap:///base??attr" */
- if ((strstr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
- (strstr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
+ if ((strcasestr (attrName, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr (attrName, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) ||
+ (strcasestr (attrName, ACL_RULE_MACRO_ATTR_KEY) != NULL)) {
matched = aclutil_evaluate_macro( attrName, &lasinfo,
ACL_EVAL_GROUPDNATTR);
@@ -4157,12 +4157,12 @@ acllas_replace_dn_macro( char *rule, char *matched_val, lasInfo *lasinfo) {
int has_macro_levels = 0;
/* Determine what the rule's got once */
- if ( strstr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
+ if ( strcasestr(rule, ACL_RULE_MACRO_DN_KEY) != NULL) {
/* ($dn) exists */
has_macro_dn = 1;
}
- if ( strstr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
+ if ( strcasestr(rule, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL) {
/* [$dn] exists */
has_macro_levels = 1;
}
@@ -4266,7 +4266,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
int l;
Slapi_Attr *attr = NULL;
- str = strstr(rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = strcasestr(rule, ACL_RULE_MACRO_ATTR_KEY);
if ( str == NULL ) {
charray_add(&a, slapi_ch_strdup(rule));
@@ -4275,7 +4275,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
} else {
working_rule = slapi_ch_strdup(rule);
- str = strstr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
charray_add(&working_list, working_rule );
while( str != NULL) {
@@ -4373,7 +4373,7 @@ acllas_replace_attr_macro( char *rule, lasInfo *lasinfo)
slapi_ch_free_string(¯o_str);
slapi_ch_free_string(¯o_attr_name);
- str = strstr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
+ str = strcasestr(working_rule, ACL_RULE_MACRO_ATTR_KEY);
}/* while */
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index cabc39f..29203da 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -276,8 +276,8 @@ __aclp__parse_aci(char *str, aci_t *aci_item, char **errbuf)
* have a target and it must have a macro.
*/
- if ((strstr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
- (strstr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
+ if ((strcasestr(str, ACL_RULE_MACRO_DN_KEY) != NULL) ||
+ (strcasestr(str, ACL_RULE_MACRO_DN_LEVELS_KEY) != NULL)) {
/* Must have a targetmacro */
if ( !(aci_item->aci_type & ACI_TARGET_MACRO_DN)) {
@@ -497,15 +497,41 @@ __aclp__sanity_check_acltxt (aci_t *aci_item, char *str)
return ACL_INCORRECT_ACI_VERSION;
}
} else if ((s = strstr(word, "($")) || (s = strstr(word, "[$"))) {
+ int attr_macro = -1;
+
+ /* See if this is a valid macro keyword. */
if ((0 != strncasecmp(s, ACL_RULE_MACRO_DN_KEY,
sizeof(ACL_RULE_MACRO_DN_KEY) - 1)) &&
(0 != strncasecmp(s, ACL_RULE_MACRO_DN_LEVELS_KEY,
sizeof(ACL_RULE_MACRO_DN_LEVELS_KEY) - 1)) &&
- (0 != strncasecmp(s, ACL_RULE_MACRO_ATTR_KEY,
- sizeof(ACL_RULE_MACRO_ATTR_KEY) - 1))) {
+ (0 != (attr_macro = strncasecmp(s, ACL_RULE_MACRO_ATTR_KEY,
+ sizeof(ACL_RULE_MACRO_ATTR_KEY) - 1)))) {
slapi_ch_free ( (void **) &newstr );
return ACL_SYNTAX_ERR;
}
+
+ /* For the $attr macro, validate that the attribute name is
+ * legal per RFC 4512. */
+ if (attr_macro == 0) {
+ int start = 1;
+ char *p = NULL;
+
+ for (p = s + sizeof(ACL_RULE_MACRO_ATTR_KEY) - 1;
+ p && *p && *p != ')'; p++) {
+ if (start) {
+ if (!isalpha(*p)) {
+ slapi_ch_free ( (void **) &newstr );
+ return ACL_SYNTAX_ERR;
+ }
+ start = 0;
+ } else {
+ if (!(isalnum(*p) || (*p == '-'))) {
+ slapi_ch_free ( (void **) &newstr );
+ return ACL_SYNTAX_ERR;
+ }
+ }
+ }
+ }
}
}
slapi_ch_free ( (void **) &newstr );
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index f33b11e..1b8bc12 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -1247,7 +1247,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
char *working_s, *suffix, *prefix, *patched;
int replace_with_len, substr_len, prefix_len, suffix_len;
- if (strstr(s, substr) == NULL) {
+ if (strcasestr(s, substr) == NULL) {
return(slapi_ch_strdup(s));
} else {
@@ -1257,7 +1257,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = slapi_ch_strdup(s);
prefix = working_s;
- str = strstr(prefix, substr);
+ str = strcasestr(prefix, substr);
while (str != NULL) {
@@ -1284,7 +1284,7 @@ acl_replace_str(char * s, char *substr, char* replace_with_str) {
working_s = patched;
prefix = working_s;
- str = strstr(prefix, substr);
+ str = strcasestr(prefix, substr);
}
--
1.8.1.4