From af25b6470bf3242a30fd3c7bbd00ed257f43c98a Mon Sep 17 00:00:00 2001 From: Anupam Jain Date: Mon, 29 Jul 2013 20:54:46 -0700 Subject: [PATCH] Ticket #626 - Possible to add nonexistent target to ACI Fix description: This patch checks if the acl target exists and logs a warning in the server log if the target does not exist. It does not, however, validate targets containing wildcards or macros --- ldap/servers/plugins/acl/acl.c | 8 +++--- ldap/servers/plugins/acl/acl.h | 7 ++++- ldap/servers/plugins/acl/acllist.c | 9 +++++-- ldap/servers/plugins/acl/aclparse.c | 51 +++++++++++++++++++++++++++++++++--- ldap/servers/plugins/acl/aclplugin.c | 2 +- ldap/servers/slapd/pblock.c | 11 ++++++++ ldap/servers/slapd/plugin_acl.c | 2 +- ldap/servers/slapd/slap.h | 4 +++ ldap/servers/slapd/slapi-plugin.h | 3 +++ 9 files changed, 84 insertions(+), 13 deletions(-) diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c index 08d8daa..5142b52 100644 --- a/ldap/servers/plugins/acl/acl.c +++ b/ldap/servers/plugins/acl/acl.c @@ -1495,7 +1495,7 @@ acl_check_mods( */ if (strcmp(mod->mod_type, aci_attr_type) == 0) { - if ( 0 != (rv = acl_verify_syntax( e_sdn, + if ( 0 != (rv = acl_verify_syntax_ext(pb, e_sdn, mod->mod_bvalues[i], errbuf))) { aclutil_print_err(rv, e_sdn, mod->mod_bvalues[i], @@ -1681,7 +1681,7 @@ acl_modified (Slapi_PBlock *pb, int optype, Slapi_DN *e_sdn, void *change) i= slapi_attr_first_value ( attr,&sval ); while ( i != -1 ) { attrVal = slapi_value_get_berval(sval); - rv= acllist_insert_aci_needsLock(e_sdn, attrVal ); + rv= acllist_insert_aci_needsLock_ext(pb, e_sdn, attrVal ); if (rv <= ACL_ERR) aclutil_print_err(rv, e_sdn, attrVal, NULL); /* Print the aci list */ @@ -1722,7 +1722,7 @@ acl_modified (Slapi_PBlock *pb, int optype, Slapi_DN *e_sdn, void *change) if (bvalue == NULL) break; for (; *bvalue != NULL; ++bvalue) { - rv=acllist_insert_aci_needsLock( e_sdn, *bvalue); + rv=acllist_insert_aci_needsLock_ext(pb, e_sdn, *bvalue); if (rv <= ACL_ERR) { aclutil_print_err(rv, e_sdn, *bvalue, NULL); @@ -1735,7 +1735,7 @@ acl_modified (Slapi_PBlock *pb, int optype, Slapi_DN *e_sdn, void *change) for (; *value != NULL; ++value) { b.bv_len = strlen (*value); b.bv_val = *value; - rv=acllist_insert_aci_needsLock( e_sdn, &b); + rv=acllist_insert_aci_needsLock_ext(pb, e_sdn, &b); if (rv <= ACL_ERR) { aclutil_print_err(rv, e_sdn, &b, NULL); diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h index d69db30..430c5b3 100644 --- a/ldap/servers/plugins/acl/acl.h +++ b/ldap/servers/plugins/acl/acl.h @@ -815,7 +815,12 @@ int acl_check_mods( Slapi_PBlock *pb, Slapi_Entry *e, LDAPMod **mods, char **e int acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf); char * acl__access2str(int access); void acl_strcpy_special (char *d, char *s); -int acl_parse(char *str, aci_t *aci_item, char **errbuf); +int acl_parse(char *str, aci_t *aci_item, char **errbuf); +int acl_parse_ext(Slapi_PBlock *pb, char * str, aci_t *aci_item, char **errbuf); +int acl_verify_aci_syntax_ext (Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf); +int acl_verify_syntax_ext(Slapi_PBlock *pb, const Slapi_DN *e_sdn, + const struct berval *bval, char **errbuf); +int acllist_insert_aci_needsLock_ext( Slapi_PBlock *pb, const Slapi_DN *e_sdn, const struct berval* aci_attr); char * acl_access2str ( int access ); int acl_init_ext (); void * acl_get_ext (ext_type type, void *object); diff --git a/ldap/servers/plugins/acl/acllist.c b/ldap/servers/plugins/acl/acllist.c index 623a739..45209de 100644 --- a/ldap/servers/plugins/acl/acllist.c +++ b/ldap/servers/plugins/acl/acllist.c @@ -97,7 +97,6 @@ static void __acllist_free_aciContainer ( AciContainer **container); void my_print( Avlnode *root ); - int acllist_init () { @@ -196,6 +195,12 @@ void acl_be_state_change_fnc ( void *handle, char *be_name, int old_state, int acllist_insert_aci_needsLock( const Slapi_DN *e_sdn, const struct berval* aci_attr) { + return(acllist_insert_aci_needsLock_ext(NULL, e_sdn, aci_attr)); +} + +int +acllist_insert_aci_needsLock_ext( Slapi_PBlock *pb, const Slapi_DN *e_sdn, const struct berval* aci_attr) +{ aci_t *aci; char *acl_str; @@ -209,7 +214,7 @@ acllist_insert_aci_needsLock( const Slapi_DN *e_sdn, const struct berval* aci_at acl_str = slapi_ch_strdup(aci_attr->bv_val); /* Parse the ACL TEXT */ - if ( 0 != (rv = acl_parse ( acl_str, aci, NULL )) ) { + if ( 0 != (rv = acl_parse_ext ( pb, acl_str, aci, NULL )) ) { slapi_log_error (SLAPI_LOG_FATAL, plugin_name, "ACL PARSE ERR(rv=%d): %s\n", rv, acl_str ); slapi_ch_free ( (void **) &acl_str ); diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c index a8a38a1..03dc14c 100644 --- a/ldap/servers/plugins/acl/aclparse.c +++ b/ldap/servers/plugins/acl/aclparse.c @@ -65,7 +65,6 @@ static int acl_verify_exactly_one_attribute( char *attr_name, Slapi_Filter *f); static int type_compare( Slapi_Filter *f, void *arg); static int acl_check_for_target_macro( aci_t *aci_item, char *value); static int get_acl_rights_as_int( char * strValue); - /*************************************************************************** * * acl_parse @@ -95,6 +94,12 @@ static int get_acl_rights_as_int( char * strValue); int acl_parse(char * str, aci_t *aci_item, char **errbuf) { + return (acl_parse_ext(NULL, str, aci_item, errbuf)); +} + +int +acl_parse_ext(Slapi_PBlock *pb, char * str, aci_t *aci_item, char **errbuf) +{ int rv=0; char *next=NULL; @@ -154,6 +159,31 @@ acl_parse(char * str, aci_t *aci_item, char **errbuf) if (!slapi_dn_issuffix(avaValue->bv_val, dn)) { return ACL_INVALID_TARGET; } + if (strcasecmp(avaValue->bv_val, dn)) { + int target_check = 0; + if (pb) + slapi_pblock_get(pb, SLAPI_ACI_TARGET_CHECK, &target_check); + if (target_check != 1) { + /* Make sure that the target exists */ + int rc = 0; + Slapi_PBlock *temppb = slapi_pblock_new(); + slapi_search_internal_set_pb(temppb, avaValue->bv_val, + LDAP_SCOPE_BASE, "(objectclass=*)", NULL, 1, NULL, NULL, + (void *)plugin_get_default_component_id(), 0); + slapi_search_internal_pb(temppb); + slapi_pblock_get(temppb, SLAPI_PLUGIN_INTOP_RESULT, &rc); + if (rc != LDAP_SUCCESS) + slapi_log_error(SLAPI_LOG_FATAL, plugin_name, + "The ACL target %s does not exist\n", avaValue->bv_val); + + slapi_free_search_results_internal(temppb); + slapi_pblock_destroy(temppb); + if (pb) { + target_check = 1; + slapi_pblock_set(pb, SLAPI_ACI_TARGET_CHECK, &target_check); + } + } + } } } @@ -1564,6 +1594,12 @@ acl_strcpy_special (char *d, char *s) int acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf) { + return (acl_verify_aci_syntax_ext (NULL, e, errbuf)); +} + +int +acl_verify_aci_syntax_ext (Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf) +{ if (e != NULL) { Slapi_DN *e_sdn; @@ -1581,7 +1617,7 @@ acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf) i= slapi_attr_first_value ( attr,&sval ); while ( i != -1 ) { attrVal = slapi_value_get_berval ( sval ); - rv = acl_verify_syntax( e_sdn, attrVal, errbuf ); + rv = acl_verify_syntax_ext( pb, e_sdn, attrVal, errbuf ); if ( 0 != rv ) { aclutil_print_err(rv, e_sdn, attrVal, errbuf); return ACL_ERR; @@ -1609,7 +1645,14 @@ acl_verify_aci_syntax (Slapi_Entry *e, char **errbuf) * **************************************************************************/ int -acl_verify_syntax(const Slapi_DN *e_sdn, +acl_verify_syntax(const Slapi_DN *e_sdn, + const struct berval *bval, char **errbuf) +{ +return (acl_verify_syntax_ext(NULL, e_sdn, bval, errbuf)); +} + +int +acl_verify_syntax_ext(Slapi_PBlock *pb, const Slapi_DN *e_sdn, const struct berval *bval, char **errbuf) { aci_t *aci_item; @@ -1620,7 +1663,7 @@ acl_verify_syntax(const Slapi_DN *e_sdn, /* make a copy the the string */ str = slapi_ch_strdup(bval->bv_val); - rv = acl_parse(str, aci_item, errbuf); + rv = acl_parse_ext(pb, str, aci_item, errbuf); /* cleanup before you leave ... */ acllist_free_aci (aci_item); diff --git a/ldap/servers/plugins/acl/aclplugin.c b/ldap/servers/plugins/acl/aclplugin.c index 0d35425..de7ba9a 100644 --- a/ldap/servers/plugins/acl/aclplugin.c +++ b/ldap/servers/plugins/acl/aclplugin.c @@ -328,7 +328,7 @@ acl_init( Slapi_PBlock *pb ) rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_START_FN, (void *) aclplugin_init ); rc = slapi_pblock_set( pb, SLAPI_PLUGIN_CLOSE_FN, (void *) aclplugin_stop ); rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_ACL_SYNTAX_CHECK, - (void *) acl_verify_aci_syntax ); + (void *) acl_verify_aci_syntax_ext ); rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_ACL_ALLOW_ACCESS, (void *) acl_access_allowed_main ); rc |= slapi_pblock_set( pb, SLAPI_PLUGIN_ACL_MODS_ALLOWED, diff --git a/ldap/servers/slapd/pblock.c b/ldap/servers/slapd/pblock.c index d88d224..72f7342 100644 --- a/ldap/servers/slapd/pblock.c +++ b/ldap/servers/slapd/pblock.c @@ -1953,6 +1953,12 @@ slapi_pblock_get( Slapi_PBlock *pblock, int arg, void *value ) (*(int *)value) = -1; } break; + + /* ACI Target Check */ + case SLAPI_ACI_TARGET_CHECK: + (*(int *)value) = pblock->pb_aci_target_check; + break; + default: LDAPDebug( LDAP_DEBUG_ANY, "Unknown parameter block argument %d\n", arg, 0, 0 ); @@ -3526,6 +3532,11 @@ slapi_pblock_set( Slapi_PBlock *pblock, int arg, void *value ) pblock->pb_paged_results_index = *(int *)value; break; + /* ACI Target Check */ + case SLAPI_ACI_TARGET_CHECK: + pblock->pb_aci_target_check = *((int *) value); + break; + default: LDAPDebug( LDAP_DEBUG_ANY, "Unknown parameter block argument %d\n", arg, 0, 0 ); diff --git a/ldap/servers/slapd/plugin_acl.c b/ldap/servers/slapd/plugin_acl.c index eebc292..e4a3a76 100644 --- a/ldap/servers/slapd/plugin_acl.c +++ b/ldap/servers/slapd/plugin_acl.c @@ -217,7 +217,7 @@ plugin_call_acl_verify_syntax ( Slapi_PBlock *pb, Slapi_Entry *e, char **errbuf if (plugin_invoke_plugin_sdn (p, SLAPI_PLUGIN_ACL_SYNTAX_CHECK, pb, (Slapi_DN*)slapi_entry_get_sdn_const (e))){ plugin_called = 1; - rc = (*p->plg_acl_syntax_check)( e, errbuf ); + rc = (*p->plg_acl_syntax_check)( pb, e, errbuf ); if ( rc != LDAP_SUCCESS ) break; } } diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h index 0aa7aad..d2fb591 100644 --- a/ldap/servers/slapd/slap.h +++ b/ldap/servers/slapd/slap.h @@ -1738,6 +1738,10 @@ typedef struct slapi_pblock { int pb_paged_results_index; /* stash SLAPI_PAGED_RESULTS_INDEX */ passwdPolicy *pwdpolicy; void *op_stack_elem; + + /* For ACI Target Check */ + int pb_aci_target_check; /* this flag prevents duplicate checking of ACI's target existence */ + } slapi_pblock; /* index if substrlens */ diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h index ecbf993..0ff946b 100644 --- a/ldap/servers/slapd/slapi-plugin.h +++ b/ldap/servers/slapd/slapi-plugin.h @@ -6994,6 +6994,9 @@ typedef struct slapi_plugindesc { /* Simple paged results index */ #define SLAPI_PAGED_RESULTS_INDEX 1945 +/* ACI Target Check */ +#define SLAPI_ACI_TARGET_CHECK 1946 + /* convenience macros for checking modify operation types */ #define SLAPI_IS_MOD_ADD(x) (((x) & ~LDAP_MOD_BVALUES) == LDAP_MOD_ADD) #define SLAPI_IS_MOD_DELETE(x) (((x) & ~LDAP_MOD_BVALUES) == LDAP_MOD_DELETE) -- 1.8.1.4