1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
|
/** BEGIN COPYRIGHT BLOCK
* Copyright 2001 Sun Microsystems, Inc.
* Portions copyright 1999, 2001-2003 Netscape Communications Corporation.
* All rights reserved.
* END COPYRIGHT BLOCK **/
/*
* Source file for the TimeOfDay and DayOfWeek LAS drivers
*/
#include <netsite.h>
#include <base/crit.h>
/* #include <plhash.h> */
#include <libaccess/acl.h>
#include "aclpriv.h"
#include <libaccess/las.h>
#include <libaccess/nserror.h>
#include "aclutil.h"
/* Generic evaluator of comparison operators in attribute evaluation
* statements.
* INPUT
* CmpOp_t ACL_TOKEN_EQ, ACL_TOKEN_NE etc.
* result 0 if equal, >0 if real > pattern, <0 if
* real < pattern.
* RETURNS
* LAS_EVAL_TRUE or LAS_EVAL_FALSE or LAS_EVAL_INVALID
* DEBUG
* Can add asserts that the strcmp failure cases are one of the
* remaining legal comparators.
*/
int
evalComparator(CmpOp_t ctok, int result)
{
if (result == 0) {
switch(ctok) {
case CMP_OP_EQ:
case CMP_OP_GE:
case CMP_OP_LE:
return LAS_EVAL_TRUE;
case CMP_OP_NE:
case CMP_OP_GT:
case CMP_OP_LT:
return LAS_EVAL_FALSE;
default:
return LAS_EVAL_INVALID;
}
} else if (result > 0) {
switch(ctok) {
case CMP_OP_GT:
case CMP_OP_GE:
case CMP_OP_NE:
return LAS_EVAL_TRUE;
case CMP_OP_LT:
case CMP_OP_LE:
case CMP_OP_EQ:
return LAS_EVAL_FALSE;
default:
return LAS_EVAL_INVALID;
}
} else { /* real < pattern */
switch(ctok) {
case CMP_OP_LT:
case CMP_OP_LE:
case CMP_OP_NE:
return LAS_EVAL_TRUE;
case CMP_OP_GT:
case CMP_OP_GE:
case CMP_OP_EQ:
return LAS_EVAL_FALSE;
default:
return LAS_EVAL_INVALID;
}
}
}
/* Takes a string and returns the same string with all uppercase
* letters converted to lowercase.
*/
void
makelower(char *string)
{
while (*string) {
*string = tolower(*string);
string++;
}
}
/* Given an LAS_EVAL_* value, translates to ACL_RES_* */
int
EvalToRes(int value)
{
switch (value) {
case LAS_EVAL_TRUE:
return ACL_RES_ALLOW;
case LAS_EVAL_FALSE:
return ACL_RES_DENY;
case LAS_EVAL_DECLINE:
return ACL_RES_FAIL;
case LAS_EVAL_FAIL:
return ACL_RES_FAIL;
case LAS_EVAL_INVALID:
return ACL_RES_INVALID;
case LAS_EVAL_NEED_MORE_INFO:
return ACL_RES_DENY;
default:
NS_ASSERT(1);
return ACL_RES_ERROR;
}
}
const char *comparator_string (int comparator)
{
static char invalid_cmp[32];
switch(comparator) {
case CMP_OP_EQ: return "CMP_OP_EQ";
case CMP_OP_NE: return "CMP_OP_NE";
case CMP_OP_GT: return "CMP_OP_GT";
case CMP_OP_LT: return "CMP_OP_LT";
case CMP_OP_GE: return "CMP_OP_GE";
case CMP_OP_LE: return "CMP_OP_LE";
default:
sprintf(invalid_cmp, "unknown comparator %d", comparator);
return invalid_cmp;
}
}
/* Return the pointer to the next token after replacing the following 'delim'
* char with NULL.
* WARNING - Modifies the first parameter */
char *acl_next_token (char **ptr, char delim)
{
char *str = *ptr;
char *token = str;
char *comma;
if (!token) { *ptr = 0; return 0; }
/* ignore leading whitespace */
while(*token && isspace(*token)) token++;
if (!*token) { *ptr = 0; return 0; }
if ((comma = strchr(token, delim)) != NULL) {
*comma++ = 0;
}
{
/* ignore trailing whitespace */
int len = strlen(token);
char *sptr = token+len-1;
while(*sptr == ' ' || *sptr == '\t') *sptr-- = 0;
}
*ptr = comma;
return token;
}
/* Returns a pointer to the next token and it's length */
/* tokens are separated by 'delim' characters */
/* ignores whitespace surrounding the tokens */
const char *acl_next_token_len (const char *ptr, char delim, int *len)
{
const char *str = ptr;
const char *token = str;
const char *comma;
*len = 0;
if (!token) { return 0; }
/* ignore leading whitespace */
while(*token && isspace(*token)) token++;
if (!*token) { return 0; }
if (*token == delim) { return token; } /* str starts with delim! */
if ((comma = strchr(token, delim)) != NULL) {
*len = comma - token;
}
else {
*len = strlen(token);
}
{
/* ignore trailing whitespace */
const char *sptr = token + *len - 1;
while(*sptr == ' ' || *sptr == '\t') {
sptr--;
(*len)--;
}
}
return token;
}
/* acl_get_req_time --
* If the REQ_TIME is available on the 'resource' plist, return it.
* Otherwise, make a system call to get the time and insert the time on the
* 'resource' PList. Allocate the time_t structure using the 'resource'
* PList's pool.
*/
time_t *acl_get_req_time (PList_t resource)
{
time_t *req_time = 0;
int rv = PListGetValue(resource, ACL_ATTR_TIME_INDEX, (void **)&req_time,
NULL);
if (rv < 0) {
req_time = (time_t *)pool_malloc(PListGetPool(resource), sizeof(time_t));
time(req_time);
PListInitProp(resource, ACL_ATTR_TIME_INDEX, ACL_ATTR_TIME,
(void *)req_time, NULL);
}
return req_time;
}
|
