Merge remote-tracking branch 'origin/mdb.master'

[openldap] / contrib / slapd-modules / allowed / allowed.c

diff --git a/contrib/slapd-modules/allowed/allowed.c b/contrib/slapd-modules/allowed/allowed.c
index 415aeefa9bed4281268f56493d040d87cbf18189..6ee246a2180bd01e7f181625b135a6843c4bf6e4 100644 (file)
--- a/contrib/slapd-modules/allowed/allowed.c
+++ b/contrib/slapd-modules/allowed/allowed.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2006-2009 The OpenLDAP Foundation.
+ * Copyright 2006-2012 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -176,9 +176,6 @@ aa_operational( Operation *op, SlapReply *rs )
        struct berval           *v;
        AttributeType           **atp = NULL;
        ObjectClass             **ocp = NULL;
-       BerVarray               bv_allowed = NULL,
-                               bv_effective = NULL;
-       int                     i, ja = 0, je = 0;
 
 #define        GOT_NONE        (0x0U)
 #define        GOT_C           (0x1U)
@@ -217,10 +214,13 @@ aa_operational( Operation *op, SlapReply *rs )
        /* shouldn't be called without an entry; please check */
        assert( rs->sr_entry != NULL );
 
+       for ( ap = &rs->sr_operational_attrs; *ap != NULL; ap = &(*ap)->a_next )
+               /* go to last */ ;
+
        /* see caveats; this is not guaranteed for all backends */
        a = attr_find( rs->sr_entry->e_attrs, slap_schema.si_ad_objectClass );
        if ( a == NULL ) {
-               return SLAP_CB_CONTINUE;
+               goto do_oc;
        }
 
        /* if client has no access to objectClass attribute; don't compute */
@@ -246,13 +246,21 @@ aa_operational( Operation *op, SlapReply *rs )
                aa_add_oc( oc, &ocp, &atp );
 
                if ( oc->soc_sups ) {
+                       int i;
+
                        for ( i = 0; oc->soc_sups[ i ] != NULL; i++ ) {
                                aa_add_oc( oc->soc_sups[ i ], &ocp, &atp );
                        }
                }
        }
 
+       ch_free( ocp );
+
        if ( atp != NULL ) {
+               BerVarray       bv_allowed = NULL,
+                               bv_effective = NULL;
+               int             i, ja = 0, je = 0;
+
                for ( i = 0; atp[ i ] != NULL; i++ )
                        /* just count */ ;
        
@@ -287,8 +295,7 @@ aa_operational( Operation *op, SlapReply *rs )
                        }
                }
 
-               for ( ap = &rs->sr_operational_attrs; *ap != NULL; ap = &(*ap)->a_next )
-                       /* go to last */ ;
+               ch_free( atp );
 
                if ( ( got & GOT_A ) && ja > 0 ) {
                        BER_BVZERO( &bv_allowed[ ja ] );
@@ -298,7 +305,7 @@ aa_operational( Operation *op, SlapReply *rs )
                        (*ap)->a_numvals = ja;
                        ap = &(*ap)->a_next;
                }
-       
+
                if ( ( got & GOT_AE ) && je > 0 ) {
                        BER_BVZERO( &bv_effective[ je ] );
                        *ap = attr_alloc( ad_allowedAttributesEffective );
@@ -307,12 +314,97 @@ aa_operational( Operation *op, SlapReply *rs )
                        (*ap)->a_numvals = je;
                        ap = &(*ap)->a_next;
                }
-       
+
                *ap = NULL;
        }
 
-       ch_free( atp );
-       ch_free( ocp );
+do_oc:;
+       if ( ( got & GOT_C ) || ( got & GOT_CE ) ) {
+               BerVarray       bv_allowed = NULL,
+                               bv_effective = NULL;
+               int             i, ja = 0, je = 0;
+
+               ObjectClass     *oc;
+
+               for ( oc_start( &oc ); oc != NULL; oc_next( &oc ) ) {
+                       /* we can only add AUXILIARY objectClasses */
+                       if ( oc->soc_kind != LDAP_SCHEMA_AUXILIARY ) {
+                               continue;
+                       }
+
+                       i++;
+               }
+
+               if ( got & GOT_C ) {
+                       bv_allowed = ber_memalloc( sizeof( struct berval ) * ( i + 1 ) );
+               }
+               if ( got & GOT_CE ) {
+                       bv_effective = ber_memalloc( sizeof( struct berval ) * ( i + 1 ) );
+               }
+
+               for ( oc_start( &oc ); oc != NULL; oc_next( &oc ) ) {
+                       /* we can only add AUXILIARY objectClasses */
+                       if ( oc->soc_kind != LDAP_SCHEMA_AUXILIARY ) {
+                               continue;
+                       }
+
+                       if ( got & GOT_C ) {
+                               ber_dupbv( &bv_allowed[ ja ], &oc->soc_cname );
+                               ja++;
+                       }
+
+                       if ( got & GOT_CE ) {
+                               if ( !access_allowed( op, rs->sr_entry,
+                                       slap_schema.si_ad_objectClass,
+                                       &oc->soc_cname, ACL_WRITE, NULL ) )
+                               {
+                                       goto done_ce;
+                               }
+
+                               if ( oc->soc_required ) {
+                                       for ( i = 0; oc->soc_required[ i ] != NULL; i++ ) {
+                                               AttributeDescription    *ad = NULL;
+                                               const char              *text = NULL;
+       
+                                               if ( slap_bv2ad( &oc->soc_required[ i ]->sat_cname, &ad, &text ) ) {
+                                                       /* log? */
+                                                       continue;
+                                               }
+
+                                               if ( !access_allowed( op, rs->sr_entry,
+                                                       ad, NULL, ACL_WRITE, NULL ) )
+                                               {
+                                                       goto done_ce;
+                                               }
+                                       }
+                               }
+
+                               ber_dupbv( &bv_effective[ je ], &oc->soc_cname );
+                               je++;
+                       }
+done_ce:;
+               }
+
+               if ( ( got & GOT_C ) && ja > 0 ) {
+                       BER_BVZERO( &bv_allowed[ ja ] );
+                       *ap = attr_alloc( ad_allowedChildClasses );
+                       (*ap)->a_vals = bv_allowed;
+                       (*ap)->a_nvals = bv_allowed;
+                       (*ap)->a_numvals = ja;
+                       ap = &(*ap)->a_next;
+               }
+
+               if ( ( got & GOT_CE ) && je > 0 ) {
+                       BER_BVZERO( &bv_effective[ je ] );
+                       *ap = attr_alloc( ad_allowedChildClassesEffective );
+                       (*ap)->a_vals = bv_effective;
+                       (*ap)->a_nvals = bv_effective;
+                       (*ap)->a_numvals = je;
+                       ap = &(*ap)->a_next;
+               }
+
+               *ap = NULL;
+       }
 
        return SLAP_CB_CONTINUE;
 }