/* $OpenLDAP$ */
/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
*
- * Copyright 1998-2008 The OpenLDAP Foundation.
+ * Copyright 1998-2012 The OpenLDAP Foundation.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
AttributeDescription *desc,
struct berval *val,
AclRegexMatches *matches,
+ slap_mask_t *mask,
AccessControlState *state );
static slap_control_t slap_acl_mask(
- AccessControl *ac, slap_mask_t *mask,
+ AccessControl *ac,
+ AccessControl *prev,
+ slap_mask_t *mask,
Operation *op, Entry *e,
AttributeDescription *desc,
struct berval *val,
{
int ret = 1;
int count;
- AccessControl *a = NULL;
+ AccessControl *a, *prev;
#ifdef LDAP_DEBUG
char accessmaskbuf[ACCESSMASK_MAXLEN];
const char *attr;
AclRegexMatches matches;
AccessControlState acl_state = ACL_STATE_INIT;
+ static AccessControlState state_init = ACL_STATE_INIT;
assert( op != NULL );
assert( e != NULL );
if ( state == NULL )
state = &acl_state;
- if ( state->as_vd_ad == desc ) {
+ if ( state->as_desc == desc &&
+ state->as_access == access &&
+ state->as_vd_acl_present )
+ {
a = state->as_vd_acl;
count = state->as_vd_acl_count;
if ( state->as_fe_done )
state->as_fe_done--;
+ ACL_PRIV_ASSIGN( mask, state->as_vd_mask );
} else {
- state->as_vi_acl = NULL;
+ *state = state_init;
a = NULL;
count = 0;
+ ACL_PRIV_ASSIGN( mask, *maskp );
}
- if ( a == NULL )
- state->as_fe_done = 0;
- ACL_PRIV_ASSIGN( mask, *maskp );
MATCHES_MEMSET( &matches );
+ prev = a;
while ( ( a = slap_acl_get( a, &count, op, e, desc, val,
- &matches, state ) ) != NULL )
+ &matches, &mask, state ) ) != NULL )
{
int i;
int dnmaxcount = MATCHES_DNMAXCOUNT( &matches );
Debug( LDAP_DEBUG_ACL, "\n", 0, 0, 0 );
}
- if ( state ) {
- if ( state->as_vi_acl == a &&
- ( state->as_recorded & ACL_STATE_RECORDED_NV ) )
- {
- Debug( LDAP_DEBUG_ACL,
- "=> slap_access_allowed: result was in cache (%s)\n",
- attr, 0, 0 );
- ret = state->as_result;
- goto done;
- } else {
- Debug( LDAP_DEBUG_ACL,
- "=> slap_access_allowed: result not in cache (%s)\n",
- attr, 0, 0 );
- }
- }
-
- control = slap_acl_mask( a, &mask, op,
+ control = slap_acl_mask( a, prev, &mask, op,
e, desc, val, &matches, count, state, access );
if ( control != ACL_BREAK ) {
}
MATCHES_MEMSET( &matches );
+ prev = a;
}
if ( ACL_IS_INVALID( mask ) ) {
slap_mask_t *maskp )
{
int ret = 1;
- AccessControl *a = NULL;
int be_null = 0;
#ifdef LDAP_DEBUG
slap_mask_t mask;
slap_access_t access_level;
const char *attr;
- static AccessControlState state_init = ACL_STATE_INIT;
assert( e != NULL );
assert( desc != NULL );
}
}
- if ( state ) {
- if ( state->as_vd_ad == desc ) {
- if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) &&
- val == NULL )
+ if ( state != NULL ) {
+ if ( state->as_desc == desc &&
+ state->as_access == access &&
+ state->as_result != -1 &&
+ !state->as_vd_acl_present )
{
+ Debug( LDAP_DEBUG_ACL,
+ "=> access_allowed: result was in cache (%s)\n",
+ attr, 0, 0 );
return state->as_result;
-
- }
} else {
- *state = state_init;
+ Debug( LDAP_DEBUG_ACL,
+ "=> access_allowed: result not in cache (%s)\n",
+ attr, 0, 0 );
}
}
done:
if ( state != NULL ) {
- /* If not value-dependent, save ACL in case of more attrs */
- if ( !( state->as_recorded & ACL_STATE_RECORDED_VD ) ) {
- state->as_vi_acl = a;
+ state->as_access = access;
state->as_result = ret;
- }
- state->as_recorded |= ACL_STATE_RECORDED;
- state->as_vd_ad = desc;
+ state->as_desc = desc;
}
if ( be_null ) op->o_bd = NULL;
if ( maskp ) ACL_PRIV_ASSIGN( *maskp, mask );
AttributeDescription *desc,
struct berval *val,
AclRegexMatches *matches,
+ slap_mask_t *mask,
AccessControlState *state )
{
const char *attr;
continue;
}
- if( !( state->as_recorded & ACL_STATE_RECORDED_VD )) {
- state->as_recorded |= ACL_STATE_RECORDED_VD;
+ if ( !state->as_vd_acl_present ) {
+ state->as_vd_acl_present = 1;
state->as_vd_acl = prev;
state->as_vd_acl_count = *count - 1;
+ ACL_PRIV_ASSIGN ( state->as_vd_mask, *mask );
}
if ( a->acl_attrval_style == ACL_STYLE_REGEX ) {
* Record value-dependent access control state
*/
#define ACL_RECORD_VALUE_STATE do { \
- if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) { \
- state->as_recorded |= ACL_STATE_RECORDED_VD; \
- state->as_vd_acl = a; \
- state->as_vd_acl_count = count; \
+ if( state && !state->as_vd_acl_present ) { \
+ state->as_vd_acl_present = 1; \
+ state->as_vd_acl = prev; \
+ state->as_vd_acl_count = count - 1; \
+ ACL_PRIV_ASSIGN( state->as_vd_mask, *mask ); \
} \
} while( 0 )
AccessControl *a,
int count,
AccessControlState *state,
+ slap_mask_t *mask,
slap_dn_access *bdn,
struct berval *opndn )
{
if ( ! bdn->a_self )
return 1;
- ACL_RECORD_VALUE_STATE;
-
/* this is a self clause, check if the target is an
* attribute.
*/
static slap_control_t
slap_acl_mask(
AccessControl *a,
+ AccessControl *prev,
slap_mask_t *mask,
Operation *op,
Entry *e,
ACL_INVALIDATE( modmask );
+ /* check for the "self" modifier in the <access> field */
+ if ( b->a_dn.a_self ) {
+ const char *dummy;
+ int rc, match = 0;
+
+ ACL_RECORD_VALUE_STATE;
+
+ /* must have DN syntax */
+ if ( desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName &&
+ !is_at_syntax( desc->ad_type, SLAPD_NAMEUID_SYNTAX )) continue;
+
+ /* check if the target is an attribute. */
+ if ( val == NULL ) continue;
+
+ /* a DN must be present */
+ if ( BER_BVISEMPTY( &op->o_ndn ) ) {
+ continue;
+ }
+
+ /* target is attribute, check if the attribute value
+ * is the op dn.
+ */
+ rc = value_match( &match, desc,
+ desc->ad_type->sat_equality, 0,
+ val, &op->o_ndn, &dummy );
+ /* on match error or no match, fail the ACL clause */
+ if ( rc != LDAP_SUCCESS || match != 0 )
+ continue;
+ }
+
/* AND <who> clauses */
if ( !BER_BVISEMPTY( &b->a_dn_pat ) ) {
Debug( LDAP_DEBUG_ACL, "<= check a_dn_pat: %s\n",
if ( b->a_dn_at != NULL ) {
if ( acl_mask_dnattr( op, e, val, a,
- count, state,
+ count, state, mask,
&b->a_dn, &op->o_ndn ) )
{
continue;
}
if ( acl_mask_dnattr( op, e, val, a,
- count, state,
+ count, state, mask,
&b->a_realdn, &ndn ) )
{
continue;
}
}
- /* check for the "self" modifier in the <access> field */
- if ( b->a_dn.a_self ) {
- const char *dummy;
- int rc, match = 0;
-
- ACL_RECORD_VALUE_STATE;
-
- /* must have DN syntax */
- if ( desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName &&
- !is_at_syntax( desc->ad_type, SLAPD_NAMEUID_SYNTAX )) continue;
-
- /* check if the target is an attribute. */
- if ( val == NULL ) continue;
-
- /* a DN must be present */
- if ( BER_BVISEMPTY( &op->o_ndn ) ) {
- continue;
- }
-
- /* target is attribute, check if the attribute value
- * is the op dn.
- */
- rc = value_match( &match, desc,
- desc->ad_type->sat_equality, 0,
- val, &op->o_ndn, &dummy );
- /* on match error or no match, fail the ACL clause */
- if ( rc != LDAP_SUCCESS || match != 0 )
- continue;
- }
-
#ifdef SLAP_DYNACL
if ( b->a_dynacl ) {
slap_dynacl_t *da;
/* fall thru to check value to add */
case LDAP_MOD_ADD:
+ case SLAP_MOD_ADD_IF_NOT_PRESENT:
assert( mlist->sml_values != NULL );
+ if ( mlist->sml_op == SLAP_MOD_ADD_IF_NOT_PRESENT
+ && attr_find( e->e_attrs, mlist->sml_desc ) )
+ {
+ break;
+ }
+
for ( bv = mlist->sml_nvalues
? mlist->sml_nvalues : mlist->sml_values;
bv->bv_val != NULL; bv++ )
break;
case LDAP_MOD_DELETE:
+ case SLAP_MOD_SOFTDEL:
if ( mlist->sml_values == NULL ) {
if ( ! access_allowed( op, e,
mlist->sml_desc, NULL,
( mlist->sml_flags & SLAP_MOD_MANAGING ) ? ACL_MANAGE : ACL_WDEL,
- NULL ) )
+ &state ) )
{
ret = 0;
goto done;
}
} else {
- assert( rs->sr_type == REP_RESULT );
+ switch ( rs->sr_type ) {
+ case REP_SEARCHREF:
+ case REP_INTERMEDIATE:
+ /* ignore */
+ break;
+
+ default:
+ assert( rs->sr_type == REP_RESULT );
+ break;
+ }
}
return 0;