Operation *op, Entry *e,
AttributeDescription *desc,
struct berval *val,
- int nmatches, regmatch_t *matches );
+ int nmatches, regmatch_t *matches,
+ AccessControlState *state );
static slap_control_t acl_mask(
AccessControl *ac, slap_mask_t *mask,
const char *attr;
regmatch_t matches[MAXREMATCHES];
int st_same_attr = 0;
- int st_initialized = 0;
static AccessControlState state_init = ACL_STATE_INIT;
assert( e != NULL );
access = ACL_AUTH;
}
- if( state && state->as_recorded && state->as_vd_ad==desc) {
- if( state->as_recorded & ACL_STATE_RECORDED_NV &&
- val == NULL )
- {
- return state->as_result;
-
- } else if ( state->as_recorded & ACL_STATE_RECORDED_VD &&
- val != NULL && state->as_vd_acl == NULL )
- {
- return state->as_result;
+ if( state ) {
+ if ( state->as_vd_ad==desc) {
+ if ( state->as_recorded ) {
+ if( state->as_recorded & ACL_STATE_RECORDED_NV &&
+ val == NULL )
+ {
+ return state->as_result;
+ } else if ( state->as_recorded & ACL_STATE_RECORDED_VD &&
+ val != NULL && state->as_vd_acl == NULL )
+ {
+ return state->as_result;
+ }
+ }
+ st_same_attr = 1;
+ } else {
+ *state = state_init;
}
- st_same_attr = 1;
- }
- if( state ) {
state->as_vd_ad=desc;
}
assert( state->as_vd_acl != NULL );
a = state->as_vd_acl;
- mask = state->as_vd_acl_mask;
count = state->as_vd_acl_count;
- AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
- goto vd_access;
+ if ( !ACL_IS_INVALID( state->as_vd_acl_mask )) {
+ mask = state->as_vd_acl_mask;
+ AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
+ goto vd_access;
+ }
} else {
if ( state ) state->as_vi_acl = NULL;
}
while((a = acl_get( a, &count, op, e, desc, val,
- MAXREMATCHES, matches )) != NULL)
+ MAXREMATCHES, matches, state )) != NULL)
{
int i;
Debug( LDAP_DEBUG_ACL, "access_allowed: result from state (%s)\n", attr, 0, 0 );
ret = state->as_result;
goto done;
- } else if (!st_initialized) {
+ } else {
Debug( LDAP_DEBUG_ACL, "access_allowed: no res from state (%s)\n", attr, 0, 0);
- *state = state_init;
- state->as_vd_ad=desc;
- st_initialized=1;
}
}
return ret;
}
+
/*
* acl_get - return the acl applicable to entry e, attribute
* attr. the acl returned is suitable for use in subsequent calls to
AttributeDescription *desc,
struct berval *val,
int nmatch,
- regmatch_t *matches )
+ regmatch_t *matches,
+ AccessControlState *state )
{
const char *attr;
int dnlen, patlen;
+ AccessControl *prev;
assert( e != NULL );
assert( count != NULL );
} else {
a = op->o_bd->be_acl;
}
+ prev = NULL;
assert( a != NULL );
} else {
+ prev = a;
a = a->acl_next;
}
if ( val == NULL ) {
continue;
}
+
+ if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) {
+ state->as_recorded |= ACL_STATE_RECORDED_VD;
+ state->as_vd_acl = prev;
+ state->as_vd_acl_count = *count;
+ state->as_vd_access = a->acl_access;
+ state->as_vd_access_count = 1;
+ ACL_INVALIDATE( state->as_vd_acl_mask );
+ }
+
if ( a->acl_attrval_style == ACL_STYLE_REGEX ) {
#ifdef NEW_LOGGING
LDAP_LOG( ACL, DETAIL1,