add new ber dump routine (behind NEW_LOGGING)

[openldap] / servers / slapd / acl.c

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index f5dbbcd75f99d6905c177bdaa4ad8eca83e12b1e..7b5d30bff6dbeab941499291d6a038abff3e9232 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -154,7 +154,7 @@ access_allowed(
        a = NULL;
        count = 0;
 
-       while( a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches ) )
+       while((a = acl_get( a, &count, be, op, e, desc, MAXREMATCHES, matches )) != NULL)
        {
                int i;
 
@@ -619,7 +619,7 @@ acl_mask(
                                buf[sizeof(buf) - 1] = 0;
                        }
 
-                       if (backend_group(be, e, buf, op->o_ndn,
+                       if (backend_group(be, conn, op, e, buf, op->o_ndn,
                                b->a_group_oc, b->a_group_at) != 0)
                        {
                                continue;
@@ -636,6 +636,45 @@ acl_mask(
                        }
                }
 
+               if ( b->a_authz.sai_ssf ) {
+                       Debug( LDAP_DEBUG_ACL, "<= check a_authz.sai_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_ssf, op->o_ssf, 0 );
+
+                       if ( b->a_authz.sai_ssf >  op->o_ssf ) {
+                               continue;
+                       }
+               }
+
+               if ( b->a_authz.sai_transport_ssf ) {
+                       Debug( LDAP_DEBUG_ACL,
+                               "<= check a_authz.sai_transport_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_transport_ssf, op->o_transport_ssf, 0 );
+
+                       if ( b->a_authz.sai_transport_ssf >  op->o_transport_ssf ) {
+                               continue;
+                       }
+               }
+
+               if ( b->a_authz.sai_tls_ssf ) {
+                       Debug( LDAP_DEBUG_ACL,
+                               "<= check a_authz.sai_tls_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_tls_ssf, op->o_tls_ssf, 0 );
+
+                       if ( b->a_authz.sai_tls_ssf >  op->o_tls_ssf ) {
+                               continue;
+                       }
+               }
+
+               if ( b->a_authz.sai_sasl_ssf ) {
+                       Debug( LDAP_DEBUG_ACL,
+                               "<= check a_authz.sai_sasl_ssf: ACL %u > OP %u\n",
+                               b->a_authz.sai_sasl_ssf, op->o_sasl_ssf, 0 );
+
+                       if ( b->a_authz.sai_sasl_ssf >  op->o_sasl_ssf ) {
+                               continue;
+                       }
+               }
+
 #ifdef SLAPD_ACI_ENABLED
                if ( b->a_aci_at != NULL ) {
                        Attribute       *at;
@@ -1223,6 +1262,7 @@ aci_group_member (
        const char *defgrpat,
     Backend            *be,
     Entry              *e,
+    Connection         *conn,
     Operation          *op,
        regmatch_t      *matches
 )
@@ -1271,7 +1311,7 @@ aci_group_member (
        if (grp_oc != NULL && grp_ad != NULL && grpdn != NULL) {
                string_expand(grpdn, 1024, subjdn, e->e_ndn, matches);
                if ( dn_normalize(grpdn) != NULL ) {
-                       rc = (backend_group(be, e, grpdn, op->o_ndn, grp_oc, grp_ad) == 0);
+                       rc = (backend_group(be, conn, op, e, grpdn, op->o_ndn, grp_oc, grp_ad) == 0);
                }
        }
 
@@ -1391,11 +1431,11 @@ aci_mask(
 
 
        } else if (aci_strbvcmp( "group", &bv ) == 0) {
-               if (aci_group_member(&sdn, SLAPD_GROUP_CLASS, SLAPD_GROUP_ATTR, be, e, op, matches))
+               if (aci_group_member(&sdn, SLAPD_GROUP_CLASS, SLAPD_GROUP_ATTR, be, e, conn, op, matches))
                        return(1);
 
        } else if (aci_strbvcmp( "role", &bv ) == 0) {
-               if (aci_group_member(&sdn, SLAPD_ROLE_CLASS, SLAPD_ROLE_ATTR, be, e, op, matches))
+               if (aci_group_member(&sdn, SLAPD_ROLE_CLASS, SLAPD_ROLE_ATTR, be, e, conn, op, matches))
                        return(1);
 
        } else if (aci_strbvcmp( "set", &bv ) == 0) {