1 /* limits.c - routines to handle regex-based size and time limits */
3 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
5 * Copyright 1998-2004 The OpenLDAP Foundation.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted only as authorized by the OpenLDAP
12 * A copy of this license is available in the file LICENSE in the
13 * top-level directory of the distribution or, alternatively, at
14 * <http://www.OpenLDAP.org/license.html>.
22 #include <ac/string.h>
30 struct slap_limits_set **limit
33 struct slap_limits **lm;
41 *limit = &op->o_bd->be_def_limit;
43 if ( op->o_bd->be_limits == NULL ) {
47 for ( lm = op->o_bd->be_limits; lm[0] != NULL; lm++ ) {
48 unsigned style = lm[0]->lm_flags & SLAP_LIMITS_MASK;
49 unsigned type = lm[0]->lm_flags & SLAP_LIMITS_TYPE_MASK;
52 case SLAP_LIMITS_EXACT:
53 if ( ndn->bv_len == 0 ) {
57 if ( type == SLAP_LIMITS_TYPE_GROUP ) {
60 rc = backend_group( op, NULL,
65 *limit = &lm[0]->lm_limits;
70 if ( dn_match( &lm[0]->lm_pat, ndn ) ) {
71 *limit = &lm[0]->lm_limits;
77 case SLAP_LIMITS_SUBTREE:
78 case SLAP_LIMITS_CHILDREN: {
81 if ( ndn->bv_len == 0 ) {
85 /* ndn shorter than dn_pat */
86 if ( ndn->bv_len < lm[0]->lm_pat.bv_len ) {
89 d = ndn->bv_len - lm[0]->lm_pat.bv_len;
91 /* allow exact match for SUBTREE only */
93 if ( style != SLAP_LIMITS_SUBTREE ) {
97 /* check for unescaped rdn separator */
98 if ( !DN_SEPARATOR( ndn->bv_val[d-1] ) ) {
103 /* in case of (sub)match ... */
104 if ( lm[0]->lm_pat.bv_len == ( ndn->bv_len - d )
105 && strcmp( lm[0]->lm_pat.bv_val,
106 &ndn->bv_val[d] ) == 0 )
108 /* check for exactly one rdn in case of ONE */
109 if ( style == SLAP_LIMITS_ONE ) {
111 * if ndn is more that one rdn
112 * below dn_pat, continue
114 if ( (size_t) dn_rdnlen( NULL, ndn )
121 *limit = &lm[0]->lm_limits;
128 case SLAP_LIMITS_REGEX:
129 if ( ndn->bv_len == 0 ) {
132 if ( regexec( &lm[0]->lm_regex, ndn->bv_val,
135 *limit = &lm[0]->lm_limits;
140 case SLAP_LIMITS_ANONYMOUS:
141 if ( ndn->bv_len == 0 ) {
142 *limit = &lm[0]->lm_limits;
147 case SLAP_LIMITS_USERS:
148 if ( ndn->bv_len != 0 ) {
149 *limit = &lm[0]->lm_limits;
154 case SLAP_LIMITS_ANY:
155 *limit = &lm[0]->lm_limits;
159 assert( 0 ); /* unreachable */
172 ObjectClass *group_oc,
173 AttributeDescription *group_ad,
174 struct slap_limits_set *limit
178 struct slap_limits *lm;
179 unsigned type, style;
184 type = flags & SLAP_LIMITS_TYPE_MASK;
185 style = flags & SLAP_LIMITS_MASK;
188 case SLAP_LIMITS_ANONYMOUS:
189 case SLAP_LIMITS_USERS:
190 case SLAP_LIMITS_ANY:
191 for ( i = 0; be->be_limits && be->be_limits[ i ]; i++ ) {
192 if ( be->be_limits[ i ]->lm_flags == style ) {
200 lm = ( struct slap_limits * )ch_calloc( sizeof( struct slap_limits ), 1 );
203 case SLAP_LIMITS_UNDEFINED:
204 style = SLAP_LIMITS_EXACT;
205 /* continue to next cases */
206 case SLAP_LIMITS_EXACT:
207 case SLAP_LIMITS_ONE:
208 case SLAP_LIMITS_SUBTREE:
209 case SLAP_LIMITS_CHILDREN:
210 lm->lm_flags = style | type;
214 bv.bv_val = (char *) pattern;
215 bv.bv_len = strlen( pattern );
217 rc = dnNormalize( 0, NULL, NULL, &bv, &lm->lm_pat, NULL );
218 if ( rc != LDAP_SUCCESS ) {
225 case SLAP_LIMITS_REGEX:
226 lm->lm_flags = style | type;
227 ber_str2bv( pattern, 0, 1, &lm->lm_pat );
228 if ( regcomp( &lm->lm_regex, lm->lm_pat.bv_val,
229 REG_EXTENDED | REG_ICASE ) ) {
230 free( lm->lm_pat.bv_val );
236 case SLAP_LIMITS_ANONYMOUS:
237 case SLAP_LIMITS_USERS:
238 case SLAP_LIMITS_ANY:
239 lm->lm_flags = style | type;
240 lm->lm_pat.bv_val = NULL;
241 lm->lm_pat.bv_len = 0;
246 case SLAP_LIMITS_TYPE_GROUP:
249 lm->lm_group_oc = group_oc;
250 lm->lm_group_ad = group_ad;
254 lm->lm_limits = *limit;
257 if ( be->be_limits != NULL ) {
258 for ( ; be->be_limits[i]; i++ );
261 be->be_limits = ( struct slap_limits ** )ch_realloc( be->be_limits,
262 sizeof( struct slap_limits * ) * ( i + 2 ) );
263 be->be_limits[i] = lm;
264 be->be_limits[i+1] = NULL;
278 int flags = SLAP_LIMITS_UNDEFINED;
280 struct slap_limits_set limit;
282 ObjectClass *group_oc = NULL;
283 AttributeDescription *group_ad = NULL;
289 LDAP_LOG( CONFIG, CRIT,
290 "%s : line %d: missing arg(s) in "
291 "\"limits <pattern> <limits>\" line.\n", fname, lineno, 0 );
293 Debug( LDAP_DEBUG_ANY,
294 "%s : line %d: missing arg(s) in "
295 "\"limits <pattern> <limits>\" line.\n%s",
301 limit = be->be_def_limit;
306 * "limits" <pattern> <limit> [ ... ]
313 * [ "dn" [ "." { "exact" | "base" | "onelevel" | "subtree" | children"
314 * | "regex" | "anonymous" } ] "=" ] <dn pattern>
317 * "exact" and "base" are the same (exact match);
318 * "onelevel" means exactly one rdn below, NOT including pattern
319 * "subtree" means any rdn below, including pattern
320 * "children" means any rdn below, NOT including pattern
322 * "anonymous" may be deprecated in favour
323 * of the pattern = "anonymous" form
325 * "group[/objectClass[/attributeType]]" "=" "<dn pattern>"
329 * "time" [ "." { "soft" | "hard" } ] "=" <integer>
331 * "size" [ "." { "soft" | "hard" | "unchecked" } ] "=" <integer>
335 if ( strcmp( pattern, "*" ) == 0) {
336 flags = SLAP_LIMITS_ANY;
338 } else if ( strcasecmp( pattern, "anonymous" ) == 0 ) {
339 flags = SLAP_LIMITS_ANONYMOUS;
341 } else if ( strcasecmp( pattern, "users" ) == 0 ) {
342 flags = SLAP_LIMITS_USERS;
344 } else if ( strncasecmp( pattern, "dn", STRLENOF( "dn" ) ) == 0 ) {
345 pattern += STRLENOF( "dn" );
346 if ( pattern[0] == '.' ) {
348 if ( strncasecmp( pattern, "exact", STRLENOF( "exact" )) == 0 ) {
349 flags = SLAP_LIMITS_EXACT;
350 pattern += STRLENOF( "exact" );
352 } else if ( strncasecmp( pattern, "base", STRLENOF( "base" ) ) == 0 ) {
353 flags = SLAP_LIMITS_BASE;
354 pattern += STRLENOF( "base" );
356 } else if ( strncasecmp( pattern, "one", STRLENOF( "one" ) ) == 0 ) {
357 flags = SLAP_LIMITS_ONE;
358 pattern += STRLENOF( "one" );
359 if ( strncasecmp( pattern, "level", STRLENOF( "level" ) ) == 0 ) {
360 pattern += STRLENOF( "level" );
364 LDAP_LOG( CONFIG, WARNING ,
365 "%s : line %d: deprecated \"one\" style "
366 "\"limits <pattern> <limits>\" line; "
367 "use \"onelevel\" instead.\n", fname, lineno, 0 );
369 Debug( LDAP_DEBUG_ANY,
370 "%s : line %d: deprecated \"one\" style "
371 "\"limits <pattern> <limits>\" line; "
372 "use \"onelevel\" instead.\n", fname, lineno, 0 );
376 } else if ( strncasecmp( pattern, "sub", STRLENOF( "sub" ) ) == 0 ) {
377 flags = SLAP_LIMITS_SUBTREE;
378 pattern += STRLENOF( "sub" );
379 if ( strncasecmp( pattern, "tree", STRLENOF( "tree" ) ) == 0 ) {
380 pattern += STRLENOF( "tree" );
384 LDAP_LOG( CONFIG, WARNING ,
385 "%s : line %d: deprecated \"sub\" style "
386 "\"limits <pattern> <limits>\" line; "
387 "use \"subtree\" instead.\n", fname, lineno, 0 );
389 Debug( LDAP_DEBUG_ANY,
390 "%s : line %d: deprecated \"sub\" style "
391 "\"limits <pattern> <limits>\" line; "
392 "use \"subtree\" instead.\n", fname, lineno, 0 );
396 } else if ( strncasecmp( pattern, "children", STRLENOF( "children" ) ) == 0 ) {
397 flags = SLAP_LIMITS_CHILDREN;
398 pattern += STRLENOF( "children" );
400 } else if ( strncasecmp( pattern, "regex", STRLENOF( "regex" ) ) == 0 ) {
401 flags = SLAP_LIMITS_REGEX;
402 pattern += STRLENOF( "regex" );
405 * this could be deprecated in favour
406 * of the pattern = "anonymous" form
408 } else if ( strncasecmp( pattern, "anonymous", STRLENOF( "anonymous" ) ) == 0 ) {
409 flags = SLAP_LIMITS_ANONYMOUS;
414 /* pre-check the data */
416 case SLAP_LIMITS_ANONYMOUS:
417 case SLAP_LIMITS_USERS:
419 /* no need for pattern */
424 if ( pattern[0] != '=' ) {
426 LDAP_LOG( CONFIG, CRIT,
427 "%s : line %d: missing '=' in "
428 "\"dn[.{exact|base|onelevel|subtree"
429 "|children|regex|anonymous}]" "=<pattern>\" in "
430 "\"limits <pattern> <limits>\" line.\n", fname, lineno, 0 );
432 Debug( LDAP_DEBUG_ANY,
433 "%s : line %d: missing '=' in "
434 "\"dn[.{exact|base|onelevel|subtree"
435 "|children|regex|anonymous}]"
437 "\"limits <pattern> <limits>\" "
444 /* skip '=' (required) */
447 /* trim obvious cases */
448 if ( strcmp( pattern, "*" ) == 0 ) {
449 flags = SLAP_LIMITS_ANY;
452 } else if ( flags == SLAP_LIMITS_REGEX
453 && strcmp( pattern, ".*" ) == 0 ) {
454 flags = SLAP_LIMITS_ANY;
459 } else if (strncasecmp( pattern, "group", STRLENOF( "group" ) ) == 0 ) {
460 pattern += STRLENOF( "group" );
462 if ( pattern[0] == '/' ) {
463 struct berval oc, ad;
465 oc.bv_val = pattern + 1;
467 ad.bv_val = strchr(pattern, '/');
468 if ( ad.bv_val != NULL ) {
469 const char *text = NULL;
472 oc.bv_len = ad.bv_val - oc.bv_val;
475 ad.bv_len = strlen( ad.bv_val );
476 rc = slap_bv2ad( &ad, &group_ad, &text );
477 if ( rc != LDAP_SUCCESS ) {
481 pattern = ad.bv_val + ad.bv_len;
484 oc.bv_len = strlen( oc.bv_val );
486 pattern = oc.bv_val + oc.bv_len;
489 group_oc = oc_bvfind( &oc );
490 if ( group_oc == NULL ) {
495 if ( group_oc == NULL ) {
496 group_oc = oc_find( SLAPD_GROUP_CLASS );
497 if ( group_oc == NULL ) {
503 if ( group_ad == NULL ) {
504 const char *text = NULL;
507 rc = slap_str2ad( SLAPD_GROUP_ATTR, &group_ad, &text );
509 if ( rc != LDAP_SUCCESS ) {
515 flags = SLAP_LIMITS_TYPE_GROUP | SLAP_LIMITS_EXACT;
517 if ( pattern[0] != '=' ) {
519 LDAP_LOG( CONFIG, CRIT,
520 "%s : line %d: missing '=' in "
521 "\"group[/objectClass[/attributeType]]"
523 "\"limits <pattern> <limits>\" line.\n",
526 Debug( LDAP_DEBUG_ANY,
527 "%s : line %d: missing '=' in "
528 "\"group[/objectClass[/attributeType]]"
530 "\"limits <pattern> <limits>\" line.\n",
536 /* skip '=' (required) */
541 for ( i = 2; i < argc; i++ ) {
542 if ( limits_parse_one( argv[i], &limit ) ) {
545 LDAP_LOG( CONFIG, CRIT,
546 "%s : line %d: unknown limit values \"%s\" in "
547 "\"limits <pattern> <limits>\" line.\n",
548 fname, lineno, argv[i] );
550 Debug( LDAP_DEBUG_ANY,
551 "%s : line %d: unknown limit values \"%s\" in "
552 "\"limits <pattern> <limits>\" line.\n",
553 fname, lineno, argv[i] );
563 * FIXME: add warnings?
565 if ( limit.lms_t_hard > 0 &&
566 ( limit.lms_t_hard < limit.lms_t_soft
567 || limit.lms_t_soft == -1 ) ) {
568 limit.lms_t_hard = limit.lms_t_soft;
571 if ( limit.lms_s_hard > 0 &&
572 ( limit.lms_s_hard < limit.lms_s_soft
573 || limit.lms_s_soft == -1 ) ) {
574 limit.lms_s_hard = limit.lms_s_soft;
583 * > 0 => limit (in seconds)
588 * > 0 => limit (in entries)
591 * -2 => disable the control
594 * > 0 => limit (in entries)
599 * > 0 => limit size (in entries)
601 if ( limit.lms_s_pr_total > 0 &&
602 limit.lms_s_pr > limit.lms_s_pr_total ) {
603 limit.lms_s_pr = limit.lms_s_pr_total;
606 rc = limits_add( be, flags, pattern, group_oc, group_ad, &limit );
610 LDAP_LOG( CONFIG, CRIT,
611 "%s : line %d: unable to add limit in "
612 "\"limits <pattern> <limits>\" line.\n",
615 Debug( LDAP_DEBUG_ANY,
616 "%s : line %d: unable to add limit in "
617 "\"limits <pattern> <limits>\" line.\n",
628 struct slap_limits_set *limit
634 if ( strncasecmp( arg, "time", STRLENOF( "time" ) ) == 0 ) {
635 arg += STRLENOF( "time" );
637 if ( arg[0] == '.' ) {
639 if ( strncasecmp( arg, "soft=", STRLENOF( "soft=" ) ) == 0 ) {
640 arg += STRLENOF( "soft=" );
641 if ( strcasecmp( arg, "none" ) == 0 ) {
642 limit->lms_t_soft = -1;
646 int soft = strtol( arg, &next, 10 );
648 if ( next == arg || next[ 0 ] != '\0' ) {
657 /* FIXME: use "none" instead */
660 limit->lms_t_soft = soft;
663 } else if ( strncasecmp( arg, "hard=", STRLENOF( "hard=" ) ) == 0 ) {
664 arg += STRLENOF( "hard=" );
665 if ( strcasecmp( arg, "soft" ) == 0 ) {
666 limit->lms_t_hard = 0;
668 } else if ( strcasecmp( arg, "none" ) == 0 ) {
669 limit->lms_t_hard = -1;
673 int hard = strtol( arg, &next, 10 );
675 if ( next == arg || next[ 0 ] != '\0' ) {
684 /* FIXME: use "none" instead */
688 /* FIXME: use "soft" instead */
691 limit->lms_t_hard = hard;
698 } else if ( arg[0] == '=' ) {
700 if ( strcasecmp( arg, "none" ) == 0 ) {
701 limit->lms_t_soft = -1;
706 limit->lms_t_soft = strtol( arg, &next, 10 );
707 if ( next == arg || limit->lms_t_soft < -1 ) {
711 limit->lms_t_hard = 0;
717 } else if ( strncasecmp( arg, "size", STRLENOF( "size" ) ) == 0 ) {
718 arg += STRLENOF( "size" );
720 if ( arg[0] == '.' ) {
722 if ( strncasecmp( arg, "soft=", STRLENOF( "soft=" ) ) == 0 ) {
723 arg += STRLENOF( "soft=" );
724 if ( strcasecmp( arg, "none" ) == 0 ) {
725 limit->lms_s_soft = -1;
729 int soft = strtol( arg, &next, 10 );
731 if ( next == arg || next[ 0 ] != '\0' ) {
740 /* FIXME: use "none" instead */
743 limit->lms_s_soft = soft;
746 } else if ( strncasecmp( arg, "hard=", STRLENOF( "hard=" ) ) == 0 ) {
747 arg += STRLENOF( "hard=" );
748 if ( strcasecmp( arg, "soft" ) == 0 ) {
749 limit->lms_s_hard = 0;
751 } else if ( strcasecmp( arg, "none" ) == 0 ) {
752 limit->lms_s_hard = -1;
756 int hard = strtol( arg, &next, 10 );
758 if ( next == arg || next[ 0 ] != '\0' ) {
767 /* FIXME: use "none" instead */
771 /* FIXME: use "soft" instead */
774 limit->lms_s_hard = hard;
777 } else if ( strncasecmp( arg, "unchecked=", STRLENOF( "unchecked=" ) ) == 0 ) {
778 arg += STRLENOF( "unchecked=" );
779 if ( strcasecmp( arg, "none" ) == 0 ) {
780 limit->lms_s_unchecked = -1;
782 } else if ( strcasecmp( arg, "disabled" ) == 0 ) {
783 limit->lms_s_unchecked = 0;
787 int unchecked = strtol( arg, &next, 10 );
789 if ( next == arg || next[ 0 ] != '\0' ) {
793 if ( unchecked < -1 ) {
797 if ( unchecked == -1 ) {
798 /* FIXME: use "none" instead */
801 limit->lms_s_unchecked = unchecked;
804 } else if ( strncasecmp( arg, "pr=", STRLENOF( "pr=" ) ) == 0 ) {
805 arg += STRLENOF( "pr=" );
806 if ( strcasecmp( arg, "noEstimate" ) == 0 ) {
807 limit->lms_s_pr_hide = 1;
809 } else if ( strcasecmp( arg, "none" ) == 0 ) {
810 limit->lms_s_pr = -1;
814 int pr = strtol( arg, &next, 10 );
816 if ( next == arg || next[ 0 ] != '\0' ) {
825 /* FIXME: use "none" instead */
828 limit->lms_s_pr = pr;
831 } else if ( strncasecmp( arg, "prtotal=", STRLENOF( "prtotal=" ) ) == 0 ) {
832 arg += STRLENOF( "prtotal=" );
834 if ( strcasecmp( arg, "none" ) == 0 ) {
835 limit->lms_s_pr_total = -1;
837 } else if ( strcasecmp( arg, "disabled" ) == 0 ) {
838 limit->lms_s_pr_total = -2;
840 } else if ( strcasecmp( arg, "hard" ) == 0 ) {
841 limit->lms_s_pr_total = 0;
847 total = strtol( arg, &next, 10 );
848 if ( next == arg || next[ 0 ] != '\0' ) {
857 /* FIXME: use "none" instead */
861 /* FIXME: use "pr=disable" instead */
864 limit->lms_s_pr_total = total;
871 } else if ( arg[0] == '=' ) {
873 if ( strcasecmp( arg, "none" ) == 0 ) {
874 limit->lms_s_soft = -1;
879 limit->lms_s_soft = strtol( arg, &next, 10 );
880 if ( next == arg || limit->lms_s_soft < -1 ) {
884 limit->lms_s_hard = 0;
896 limits_check( Operation *op, SlapReply *rs )
900 /* FIXME: should this be always true? */
901 assert( op->o_tag == LDAP_REQ_SEARCH);
903 /* allow root to set no limit */
904 if ( be_isroot( op ) ) {
905 op->ors_limit = NULL;
907 if ( op->ors_tlimit == 0 ) {
911 if ( op->ors_slimit == 0 ) {
915 /* if not root, get appropriate limits */
917 ( void ) limits_get( op, &op->o_ndn, &op->ors_limit );
919 assert( op->ors_limit != NULL );
921 /* if no limit is required, use soft limit */
922 if ( op->ors_tlimit == 0 ) {
923 op->ors_tlimit = op->ors_limit->lms_t_soft;
925 /* limit required: check if legal */
927 if ( op->ors_limit->lms_t_hard == 0 ) {
928 if ( op->ors_limit->lms_t_soft > 0
929 && ( op->ors_tlimit < 0 || op->ors_tlimit > op->ors_limit->lms_t_soft ) ) {
930 op->ors_tlimit = op->ors_limit->lms_t_soft;
933 } else if ( op->ors_limit->lms_t_hard > 0 ) {
934 if ( op->ors_tlimit < 0 || op->ors_tlimit > op->ors_limit->lms_t_hard ) {
935 /* error if exceeding hard limit */
936 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
937 send_ldap_result( op, rs );
938 rs->sr_err = LDAP_SUCCESS;
944 /* else leave as is */
946 /* don't even get to backend if candidate check is disabled */
947 if ( op->ors_limit->lms_s_unchecked == 0 ) {
948 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
949 send_ldap_result( op, rs );
950 rs->sr_err = LDAP_SUCCESS;
954 /* if paged results is requested */
955 if ( get_pagedresults( op ) ) {
959 /* paged results is not allowed */
960 if ( op->ors_limit->lms_s_pr_total == -2 ) {
961 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
962 rs->sr_text = "pagedResults control not allowed";
963 send_ldap_result( op, rs );
964 rs->sr_err = LDAP_SUCCESS;
969 if ( op->ors_limit->lms_s_pr > 0 && op->o_pagedresults_size > op->ors_limit->lms_s_pr ) {
970 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
971 rs->sr_text = "illegal pagedResults page size";
972 send_ldap_result( op, rs );
973 rs->sr_err = LDAP_SUCCESS;
978 if ( op->ors_limit->lms_s_pr_total == 0 ) {
979 if ( op->ors_limit->lms_s_hard == 0 ) {
980 pr_total = op->ors_limit->lms_s_soft;
982 pr_total = op->ors_limit->lms_s_hard;
985 pr_total = op->ors_limit->lms_s_pr_total;
988 if ( op->ors_limit->lms_s_pr_total == -1 ) {
991 } else if ( pr_total > 0 && ( op->ors_slimit == -1 || op->ors_slimit > pr_total ) ) {
992 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
993 send_ldap_result( op, rs );
994 rs->sr_err = LDAP_SUCCESS;
998 /* if no limit is required, use soft limit */
1002 /* first round of pagedResults: set count to any appropriate limit */
1004 /* if the limit is set, check that it does not violate any limit */
1005 if ( op->ors_slimit > 0 ) {
1006 slimit2 = op->ors_slimit;
1008 } else if ( op->ors_slimit == 0 ) {
1015 total = slimit2 - op->o_pagedresults_state.ps_count;
1018 if ( op->ors_limit->lms_s_pr > 0 ) {
1019 /* use the smallest limit set by total/per page */
1020 if ( total < op->ors_limit->lms_s_pr ) {
1024 /* use the perpage limit if any
1025 * NOTE: + 1 because the given value must be legal */
1026 slimit = op->ors_limit->lms_s_pr + 1;
1030 /* use the total limit if any */
1034 } else if ( op->ors_limit->lms_s_pr > 0 ) {
1035 /* use the perpage limit if any
1036 * NOTE: + 1 because the given value must be legal */
1037 slimit = op->ors_limit->lms_s_pr + 1;
1040 /* use the standard hard/soft limit if any */
1041 slimit = op->ors_limit->lms_s_hard;
1045 /* if got any limit, use it */
1046 if ( slimit != -2 ) {
1047 if ( op->ors_slimit <= 0 ) {
1048 op->ors_slimit = slimit;
1050 } else if ( op->ors_slimit - op->o_pagedresults_state.ps_count > slimit ) {
1051 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
1052 send_ldap_result( op, rs );
1053 rs->sr_err = LDAP_SUCCESS;
1057 op->ors_slimit = slimit;
1061 /* use the standard hard/soft limit if any */
1062 op->ors_slimit = op->ors_limit->lms_s_hard;
1065 /* no limit requested: use soft, whatever it is */
1066 } else if ( op->ors_slimit == 0 ) {
1067 op->ors_slimit = op->ors_limit->lms_s_soft;
1069 /* limit requested: check if legal */
1071 /* hard limit as soft (traditional behavior) */
1072 if ( op->ors_limit->lms_s_hard == 0 ) {
1073 if ( op->ors_limit->lms_s_soft > 0
1074 && op->ors_slimit > op->ors_limit->lms_s_soft ) {
1075 op->ors_slimit = op->ors_limit->lms_s_soft;
1078 /* explicit hard limit: error if violated */
1079 } else if ( op->ors_limit->lms_s_hard > 0 ) {
1080 if ( op->ors_slimit > op->ors_limit->lms_s_hard ) {
1081 /* if limit exceeds hard, error */
1082 rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED;
1083 send_ldap_result( op, rs );
1084 rs->sr_err = LDAP_SUCCESS;
1090 /* else leave as is */