document option '-F'

[openldap] / servers / slapd / back-bdb / search.c

diff --git a/servers/slapd/back-bdb/search.c b/servers/slapd/back-bdb/search.c
index d2d5812ee559ffa6ca6c0e45562c0b84c787d10f..830497e49fa82c2371a055d83bbd653cf49b625f 100644 (file)
--- a/servers/slapd/back-bdb/search.c
+++ b/servers/slapd/back-bdb/search.c
@@ -43,9 +43,6 @@ static void send_paged_response(
        ID  *lastid,
        int tentries );
 
-static int bdb_pfid_cmp( const void *v_id1, const void *v_id2 );
-static ID* bdb_id_dup( Operation *op, ID *id );
-
 /* Dereference aliases for a single alias entry. Return the final
  * dereferenced entry on success, NULL on any failure.
  */
@@ -153,7 +150,11 @@ static int search_aliases(
        Entry *matched, *a;
        EntryInfo *ei;
        struct berval bv_alias = BER_BVC( "alias" );
-       AttributeAssertion aa_alias;
+#ifdef LDAP_COMP_MATCH
+       AttributeAssertion aa_alias = { NULL, BER_BVNULL, NULL };
+#else
+       AttributeAssertion aa_alias = { NULL, BER_BVNULL };
+#endif
        Filter  af;
        DB_LOCK locka, lockr;
        int first = 1;
@@ -313,6 +314,7 @@ bdb_search( Operation *op, SlapReply *rs )
        Entry           *matched = NULL;
        EntryInfo       *ei, ei_root = {0};
        struct berval   realbase = BER_BVNULL;
+       slap_mask_t     mask;
        int             manageDSAit;
        int             tentries = 0;
        ID              lastid = NOID;
@@ -396,13 +398,18 @@ dn2entry_retry:
                if ( matched != NULL ) {
                        BerVarray erefs = NULL;
 
+#ifdef SLAP_ACL_HONOR_DISCLOSE
+                       /* return referral only if "disclose"
+                        * is granted on the object */
                        if ( ! access_allowed( op, matched,
                                                slap_schema.si_ad_entry,
                                                NULL, ACL_DISCLOSE, NULL ) )
                        {
                                rs->sr_err = LDAP_NO_SUCH_OBJECT;
 
-                       } else {
+                       } else
+#endif /* SLAP_ACL_HONOR_DISCLOSE */
+                       {
                                ber_dupbv( &matched_dn, &matched->e_name );
 
                                erefs = is_entry_referral( matched )
@@ -449,10 +456,17 @@ dn2entry_retry:
                return rs->sr_err;
        }
 
-       if ( ! access_allowed( op, e, slap_schema.si_ad_entry,
-                               NULL, ACL_DISCLOSE, NULL ) )
+#ifdef SLAP_ACL_HONOR_DISCLOSE
+       /* NOTE: __NEW__ "search" access is required
+        * on searchBase object */
+       if ( ! access_allowed_mask( op, e, slap_schema.si_ad_entry,
+                               NULL, ACL_SEARCH, NULL, &mask ) )
        {
-               rs->sr_err = LDAP_NO_SUCH_OBJECT;
+               if ( !ACL_GRANT( mask, ACL_DISCLOSE ) ) {
+                       rs->sr_err = LDAP_NO_SUCH_OBJECT;
+               } else {
+                       rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
+               }
 
 #ifdef SLAP_ZONE_ALLOC
                slap_zn_runlock(bdb->bi_cache.c_zctx, e);
@@ -463,6 +477,7 @@ dn2entry_retry:
                send_ldap_result( op, rs );
                return 1;
        }
+#endif /* SLAP_ACL_HONOR_DISCLOSE */
 
        if ( !manageDSAit && e != &e_root && is_entry_referral( e ) ) {
                /* entry is a referral, don't allow add */
@@ -623,19 +638,16 @@ dn2entry_retry:
                goto loop_begin;
        }
 
-loop_start:
-
        for ( id = bdb_idl_first( candidates, &cursor );
                  id != NOID ; id = bdb_idl_next( candidates, &cursor ) )
        {
                int scopeok = 0;
-               ID* idhole = NULL;
 
 loop_begin:
 
                /* check for abandon */
                if ( op->o_abandon ) {
-                       rs->sr_err = LDAP_SUCCESS;
+                       rs->sr_err = SLAPD_ABANDON;
                        goto done;
                }
 
@@ -1008,10 +1020,18 @@ static int search_candidates(
        int rc, depth = 1;
        Filter          f, rf, xf, nf;
        ID              *stack;
-       AttributeAssertion aa_ref;
+#ifdef LDAP_COMP_MATCH
+       AttributeAssertion aa_ref = { NULL, BER_BVNULL, NULL };
+#else
+       AttributeAssertion aa_ref = { NULL, BER_BVNULL };
+#endif
 #ifdef BDB_SUBENTRIES
        Filter  sf;
-       AttributeAssertion aa_subentry;
+#ifdef LDAP_COMP_MATCH
+       AttributeAssertion aa_subentry = { NULL, BER_BVNULL, NULL };
+#else
+       AttributeAssertion aa_subentry = { NULL, BER_BVNULL };
+#endif
 #endif
 
        /*
@@ -1241,7 +1261,8 @@ send_paged_response(
 
        op->o_conn->c_pagedresults_state.ps_cookie = respcookie;
        op->o_conn->c_pagedresults_state.ps_count =
-               ((PagedResultsState *)op->o_pagedresults_state)->ps_count + rs->sr_nentries;
+               ((PagedResultsState *)op->o_pagedresults_state)->ps_count +
+               rs->sr_nentries;
 
        /* return size of 0 -- no estimate */
        ber_printf( ber, "{iO}", 0, &cookie ); 
@@ -1262,18 +1283,3 @@ done:
        (void) ber_free_buf( ber );
 }
 
-static int
-bdb_pfid_cmp( const void *v_id1, const void *v_id2 )
-{
-    const ID *p1 = v_id1, *p2 = v_id2;
-       return *p1 - *p2;
-}
-
-static ID*
-bdb_id_dup( Operation *op, ID *id )
-{
-       ID *new;
-       new = ch_malloc( sizeof(ID) );
-       *new = *id;
-       return new;
-}