possible small bug in acl.c

["Mark Blackman" <mark.blackman@netscalibur.co.uk>]

First of all, let me say thanks for all the work that has been
put in get openldap to this level.

I'm posting this to the developers list as I need help interpreting the
intentions of the coders as expressed in servers/slapd/acl.c.

Depending on whether or not I understand the acl_mask code correctly, there
may be a bug/typo in the peername ACL code.

specifically in 2.0.18/servers/slapd/acl.c
(some whitespace removed/line numbers added)

522 if ( b->a_peername_pat != NULL ) {
523         Debug( LDAP_DEBUG_ACL, "<= check a_peername_path: %s\n",
524                 b->a_peername_pat, 0, 0 );
525 
526         if ( strcmp( b->a_peername_pat, "*" ) != 0) {
527                 if ( b->a_peername_style == ACL_STYLE_REGEX) {
528                         if (!regex_matches( b->a_peername_pat, conn->c_peer_name,
529                                         e->e_ndn, matches ) ) 
530                         {
531                                 continue;
532                         }
533                 } else {
534                         if ( strcasecmp( b->a_peername_pat, conn->c_peer_name ) == 0 )
535                                 continue;
536                 }
537         }
538 }

I believe that the "continue" control statement is called on ACL match
**failure**, but the strcasecmp comparison (corresponding to a peername.exact)
on line 534 goes to "continue" when there **is** a match (strcasecmp==0)
between the <who> clause and the peername. This same form occurs in a few
other places as well (line 498,516,552).

Either this is a typo/bug or I'm not interpreting this code properly. In any
case, it appears to do the wrong thing as I always get an apparent peername match on
the first peername when its a non-match. 

I'm just asking if this is intentional logic or a typo?

As a final note, I find it rather unexpected that conn->c_peer_name appears be
of the form "IP=xxx.xxx.xxx.xxx:yyy" rather than just "xxx.xxx.xxx.xxx".
Ideally this would be documented in the OpenLDAP administrators guide either
as an example or as an explicit requirement.

I'm ignoring the ACL_REGEX forms because my regex engine seems to be a bit
slow (FreeBSD), which is why I've noticed these effects.

Thanks
Mark Blackman
Senior Systems Administrator		Tel: +44 (0)870 887 8896
Netscalibur UK Limited			Fax: +44 (0)870 887 8868