add logs; fix bug in group/dn selection logic

[openldap] / servers / slapd / acl.c

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index c4f4d2bdcce1da5b7deb7b490c94822851833741..c337b8fe78ee8e21c61085933a4dbdda32b2362a 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -80,7 +80,8 @@ static AccessControl * acl_get(
        Operation *op, Entry *e,
        AttributeDescription *desc,
        struct berval *val,
-       int nmatches, regmatch_t *matches );
+       int nmatches, regmatch_t *matches,
+       AccessControlState *state );
 
 static slap_control_t acl_mask(
        AccessControl *ac, slap_mask_t *mask,
@@ -156,7 +157,6 @@ access_allowed(
        const char *attr;
        regmatch_t matches[MAXREMATCHES];
        int        st_same_attr = 0;
-       int        st_initialized = 0;
        static AccessControlState state_init = ACL_STATE_INIT;
 
        assert( e != NULL );
@@ -173,21 +173,24 @@ access_allowed(
                access = ACL_AUTH;
        }
 
-       if( state && state->as_recorded && state->as_vd_ad==desc) { 
-               if( state->as_recorded & ACL_STATE_RECORDED_NV &&
-                       val == NULL )
-               {
-                       return state->as_result;
-
-               } else if ( state->as_recorded & ACL_STATE_RECORDED_VD &&
-                       val != NULL && state->as_vd_acl == NULL )
-               {
-                       return state->as_result;
+       if( state ) {
+               if ( state->as_vd_ad==desc) {
+                       if ( state->as_recorded ) {
+                               if( state->as_recorded & ACL_STATE_RECORDED_NV &&
+                                       val == NULL )
+                               {
+                                       return state->as_result;
+                               } else if ( state->as_recorded & ACL_STATE_RECORDED_VD &&
+                                       val != NULL && state->as_vd_acl == NULL )
+                               {
+                                       return state->as_result;
+                               }
+                       }
+                       st_same_attr = 1;
+               } else {
+                       *state = state_init;
                }
-               st_same_attr = 1;
-       }
 
-       if( state ) {
                state->as_vd_ad=desc;
        }
 
@@ -225,7 +228,7 @@ access_allowed(
 #endif /* LDAP_SLAPI */
 
        /* grant database root access */
-       if ( be != NULL && be_isroot( be, &op->o_ndn ) ) {
+       if ( be != NULL && be_isroot( op ) ) {
 #ifdef NEW_LOGGING
                LDAP_LOG( ACL, INFO, 
                        "access_allowed: conn %lu root access granted\n", 
@@ -305,10 +308,12 @@ access_allowed(
                assert( state->as_vd_acl != NULL );
 
                a = state->as_vd_acl;
-               mask = state->as_vd_acl_mask;
                count = state->as_vd_acl_count;
-               AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
-               goto vd_access;
+               if ( !ACL_IS_INVALID( state->as_vd_acl_mask )) {
+                       mask = state->as_vd_acl_mask;
+                       AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
+                       goto vd_access;
+               }
 
        } else {
                if ( state ) state->as_vi_acl = NULL;
@@ -319,7 +324,7 @@ access_allowed(
        }
 
        while((a = acl_get( a, &count, op, e, desc, val,
-               MAXREMATCHES, matches )) != NULL)
+               MAXREMATCHES, matches, state )) != NULL)
        {
                int i;
 
@@ -350,11 +355,8 @@ access_allowed(
                                Debug( LDAP_DEBUG_ACL, "access_allowed: result from state (%s)\n", attr, 0, 0 );
                                ret = state->as_result;
                                goto done;
-                       } else if (!st_initialized) {
+                       } else {
                                Debug( LDAP_DEBUG_ACL, "access_allowed: no res from state (%s)\n", attr, 0, 0);
-                           *state = state_init;
-                               state->as_vd_ad=desc;
-                               st_initialized=1;
                        }
                }
 
@@ -421,6 +423,7 @@ done:
        return ret;
 }
 
+
 /*
  * acl_get - return the acl applicable to entry e, attribute
  * attr.  the acl returned is suitable for use in subsequent calls to
@@ -436,10 +439,12 @@ acl_get(
        AttributeDescription *desc,
        struct berval   *val,
        int                     nmatch,
-       regmatch_t      *matches )
+       regmatch_t      *matches,
+       AccessControlState *state )
 {
        const char *attr;
        int dnlen, patlen;
+       AccessControl *prev;
 
        assert( e != NULL );
        assert( count != NULL );
@@ -455,10 +460,12 @@ acl_get(
                } else {
                        a = op->o_bd->be_acl;
                }
+               prev = NULL;
 
                assert( a != NULL );
 
        } else {
+               prev = a;
                a = a->acl_next;
        }
 
@@ -545,6 +552,16 @@ acl_get(
                        if ( val == NULL ) {
                                continue;
                        }
+
+                       if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) {
+                               state->as_recorded |= ACL_STATE_RECORDED_VD;
+                               state->as_vd_acl = prev;
+                               state->as_vd_acl_count = *count;
+                               state->as_vd_access = a->acl_access;
+                               state->as_vd_access_count = 1;
+                               ACL_INVALIDATE( state->as_vd_acl_mask );
+                       }
+
                        if ( a->acl_attrval_style == ACL_STYLE_REGEX ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG( ACL, DETAIL1, 
@@ -1190,7 +1207,7 @@ dn_match_cleanup:;
 
                if ( b->a_group_pat.bv_len ) {
                        struct berval bv;
-                       struct berval ndn = { 0, NULL };
+                       struct berval ndn = BER_BVNULL;
                        int rc;
 
                        if ( op->o_ndn.bv_len == 0 ) {
@@ -1551,7 +1568,7 @@ acl_check_modlist(
        assert( be != NULL );
 
        /* short circuit root database access */
-       if ( be_isroot( op->o_bd, &op->o_ndn ) ) {
+       if ( be_isroot( op ) ) {
 #ifdef NEW_LOGGING
                LDAP_LOG( ACL, DETAIL1, 
                           "acl_check_modlist: conn %lu  access granted to root user\n",
@@ -1615,12 +1632,12 @@ acl_check_modlist(
                                goto done;
                        }
 
-                       if ( mlist->sml_bvalues == NULL ) break;
+                       if ( mlist->sml_values == NULL ) break;
 
                        /* fall thru to check value to add */
 
                case LDAP_MOD_ADD:
-                       assert( mlist->sml_bvalues != NULL );
+                       assert( mlist->sml_values != NULL );
 
                        for ( bv = mlist->sml_nvalues
                                        ? mlist->sml_nvalues : mlist->sml_values;
@@ -1636,7 +1653,7 @@ acl_check_modlist(
                        break;
 
                case LDAP_MOD_DELETE:
-                       if ( mlist->sml_bvalues == NULL ) {
+                       if ( mlist->sml_values == NULL ) {
                                if ( ! access_allowed( op, e,
                                        mlist->sml_desc, NULL, ACL_WRITE, NULL ) )
                                {
@@ -1746,14 +1763,14 @@ aci_match_set (
        int setref
 )
 {
-       struct berval set = { 0, NULL };
+       struct berval set = BER_BVNULL;
        int rc = 0;
        AciSetCookie cookie;
 
        if (setref == 0) {
                ber_dupbv_x( &set, subj, op->o_tmpmemctx );
        } else {
-               struct berval subjdn, ndn = { 0, NULL };
+               struct berval subjdn, ndn = BER_BVNULL;
                struct berval setat;
                BerVarray bvals;
                const char *text;