Forced commit, partially revert prev commit

[openldap] / servers / slapd / acl.c

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index 39857052f8244932f2286658f8f3640c1cfc8031..88ee0a62df1ecef830091fe550bf9a06ae466f3d 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2006 The OpenLDAP Foundation.
+ * Copyright 1998-2007 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -234,13 +234,13 @@ slap_access_allowed(
                                ( state->as_recorded & ACL_STATE_RECORDED_NV ) )
                        {
                                Debug( LDAP_DEBUG_ACL,
-                                       "=> slap_access_allowed: result from state (%s)\n",
+                                       "=> slap_access_allowed: result was in cache (%s)\n",
                                        attr, 0, 0 );
                                ret = state->as_result;
                                goto done;
                        } else {
                                Debug( LDAP_DEBUG_ACL,
-                                       "=> slap_access_allowed: no res from state (%s)\n",
+                                       "=> slap_access_allowed: result not in cache (%s)\n",
                                        attr, 0, 0 );
                        }
                }
@@ -304,7 +304,7 @@ fe_access_allowed(
        be_orig = op->o_bd;
 
        if ( op->o_bd == NULL ) {
-               op->o_bd = select_backend( &op->o_req_ndn, 0, 0 );
+               op->o_bd = select_backend( &op->o_req_ndn, 0 );
                if ( op->o_bd == NULL )
                        op->o_bd = frontendDB;
        }
@@ -351,7 +351,10 @@ access_allowed_mask(
        assert( attr != NULL );
 
        if ( op ) {
-               if ( op->o_is_auth_check &&
+               if ( op->o_acl_priv != ACL_NONE ) {
+                       access = op->o_acl_priv;
+
+               } else if ( op->o_is_auth_check &&
                        ( access_level == ACL_SEARCH || access_level == ACL_READ ) )
                {
                        access = ACL_AUTH;
@@ -971,11 +974,10 @@ acl_mask_dnattr(
                at != NULL;
                at = attrs_find( at->a_next, bdn->a_at ) )
        {
-               if ( value_find_ex( bdn->a_at,
+               if ( attr_valfind( at,
                        SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
                                SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
-                       at->a_nvals,
-                       &bv, op->o_tmpmemctx ) == 0 )
+                       &bv, NULL, op->o_tmpmemctx ) == 0 )
                {
                        /* found it */
                        match = 1;
@@ -1326,7 +1328,7 @@ slap_acl_mask(
                                                char            buf[] = "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF";
                                                struct berval   ip;
                                                struct in6_addr addr;
-                                               int             port_number = -1, i;
+                                               int             port_number = -1;
                                                
                                                if ( strncasecmp( op->o_conn->c_peer_name.bv_val, 
                                                                        acl_bv_ipv6_eq.bv_val,
@@ -1359,15 +1361,7 @@ slap_acl_mask(
                                                        continue;
 
                                                /* check mask */
-                                               for ( i = 0; i < 4; i++ ) {
-                                                       if ( ( addr.s6_addr32[i] & b->a_peername_mask6.s6_addr32[i] )
-                                                               != b->a_peername_addr6.s6_addr32[i] )
-                                                       {
-                                                               break;
-                                                       }
-                                               }
-
-                                               if ( i != 4 )
+                                               if ( !slap_addr6_mask( &addr, &b->a_peername_mask6, &b->a_peername_addr6 ) )
                                                        continue;
 #endif /* LDAP_PF_INET6 */
 
@@ -2048,17 +2042,12 @@ acl_set_cb_gather( Operation *op, SlapReply *rs )
 
                                a = attr_find( rs->sr_entry->e_attrs, desc );
                                if ( a != NULL ) {
-                                       int     i;
-
-                                       for ( i = 0; !BER_BVISNULL( &a->a_nvals[ i ] ); i++ )
-                                               ;
-
                                        bvalsp = a->a_nvals;
                                }
                        }
                }
 
-               if ( bvals ) {
+               if ( bvalsp ) {
                        p->bvals = slap_set_join( p->cookie, p->bvals,
                                        ( '|' | SLAP_SET_RREF ), bvalsp );
                }
@@ -2083,7 +2072,6 @@ acl_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *de
        slap_callback           cb = { NULL, acl_set_cb_gather, NULL, NULL };
        acl_set_gather_t        p = { 0 };
        const char              *text = NULL;
-       static struct berval    defaultFilter_bv = BER_BVC( "(objectClass=*)" );
 
        /* this routine needs to return the bervals instead of
         * plain strings, since syntax is not known.  It should
@@ -2116,7 +2104,7 @@ acl_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *de
                goto url_done;
        }
 
-       op2.o_bd = select_backend( &op2.o_req_ndn, 0, 1 );
+       op2.o_bd = select_backend( &op2.o_req_ndn, 1 );
        if ( ( op2.o_bd == NULL ) || ( op2.o_bd->be_search == NULL ) ) {
                rc = LDAP_NO_SUCH_OBJECT;
                goto url_done;
@@ -2126,16 +2114,17 @@ acl_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *de
        if ( ludp->lud_filter ) {
                ber_str2bv_x( ludp->lud_filter, 0, 0, &op2.ors_filterstr,
                                cp->asc_op->o_tmpmemctx );
+               op2.ors_filter = str2filter_x( cp->asc_op, op2.ors_filterstr.bv_val );
+               if ( op2.ors_filter == NULL ) {
+                       rc = LDAP_PROTOCOL_ERROR;
+                       goto url_done;
+               }
                
        } else {
-               op2.ors_filterstr = defaultFilter_bv;
+               op2.ors_filterstr = *slap_filterstr_objectClass_pres;
+               op2.ors_filter = slap_filter_objectClass_pres;
        }
 
-       op2.ors_filter = str2filter_x( cp->asc_op, op2.ors_filterstr.bv_val );
-       if ( op2.ors_filter == NULL ) {
-               rc = LDAP_PROTOCOL_ERROR;
-               goto url_done;
-       }
 
        /* Grab the scope */
        op2.ors_scope = ludp->lud_scope;
@@ -2191,7 +2180,7 @@ acl_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *de
        }
 
 url_done:;
-       if ( op2.ors_filter ) {
+       if ( op2.ors_filter && op2.ors_filter != slap_filter_objectClass_pres ) {
                filter_free_x( cp->asc_op, op2.ors_filter );
        }
        if ( !BER_BVISNULL( &op2.o_req_ndn ) ) {