- }
- Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
- accessmask2str(tgrant, accessmaskbuf, 1),
- accessmask2str(tdeny, accessmaskbuf1, 1), 0);
-
- }
- /* If the entry level aci didn't contain anything valid for the
- * current operation, climb up the tree and evaluate the
- * acis with scope set to subtree
- */
- if ( (tgrant == ACL_PRIV_NONE) && (tdeny == ACL_PRIV_NONE) ) {
- dnParent( &e->e_nname, &parent_ndn );
- while ( !BER_BVISEMPTY( &parent_ndn ) ) {
- Debug(LDAP_DEBUG_ACL, "checking ACI of %s\n", parent_ndn.bv_val, 0, 0);
- ret = backend_attribute(op, NULL, &parent_ndn, b->a_aci_at, &bvals, ACL_AUTH);
- switch(ret){
- case LDAP_SUCCESS :
- stop = 0;
- if (!bvals){
- break;
- }
-
- for( i = 0; bvals[i].bv_val != NULL; i++){
-#if 0
- /* FIXME: this breaks acl caching;
- * see also ACL_RECORD_VALUE_STATE above */
- ACL_RECORD_VALUE_STATE;
-#endif
- if (aci_mask(op, e, desc, val, &bvals[i],
- nmatch, matches,
- &grant, &deny, SLAP_ACI_SCOPE_CHILDREN ) != 0 )
- {
- tgrant |= grant;
- tdeny |= deny;
- /* evaluation stops as soon as either a "deny" or a
- * "grant" directive matches.
- */
- if( (tgrant != ACL_PRIV_NONE) || (tdeny != ACL_PRIV_NONE) ){
- stop = 1;
- }
- }
- Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
- accessmask2str(tgrant, accessmaskbuf, 1),
- accessmask2str(tdeny, accessmaskbuf1, 1), 0);
- }
- break;