Experiment with busy loop protection...

[openldap] / servers / slapd / filterentry.c

diff --git a/servers/slapd/filterentry.c b/servers/slapd/filterentry.c
index 7190c7bf4aeddadbf45034bd4aff4e4dbf8a23e3..deb47e4b8099b2b8a7790e819be9213b02e29260 100644 (file)
--- a/servers/slapd/filterentry.c
+++ b/servers/slapd/filterentry.c
@@ -57,7 +57,7 @@ test_filter(
 
 #ifdef NEW_LOGGING
        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_filter: begin\n" ));
+                  "test_filter: begin\n" ));
 #else
        Debug( LDAP_DEBUG_FILTER, "=> test_filter\n", 0, 0, 0 );
 #endif
@@ -66,13 +66,13 @@ test_filter(
        switch ( f->f_choice ) {
        case SLAPD_FILTER_COMPUTED:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter:   COMPUTED %s (%d)\n",
-                       f->f_result == LDAP_COMPARE_FALSE ? "false" :
-                       f->f_result == LDAP_COMPARE_TRUE  ? "true"  :
-                       f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" :
-                       "error",
-                       f->f_result ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter:   COMPUTED %s (%d)\n",
+                          f->f_result == LDAP_COMPARE_FALSE ? "false" :
+                          f->f_result == LDAP_COMPARE_TRUE      ? "true"  :
+                          f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" :
+                          "error",
+                          f->f_result ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    COMPUTED %s (%d)\n",
                        f->f_result == LDAP_COMPARE_FALSE ? "false" :
@@ -86,8 +86,8 @@ test_filter(
 
        case LDAP_FILTER_EQUALITY:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter:   EQUALITY\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter:   EQUALITY\n" ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    EQUALITY\n", 0, 0, 0 );
 #endif
@@ -98,8 +98,8 @@ test_filter(
 
        case LDAP_FILTER_SUBSTRINGS:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter  SUBSTRINGS\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter  SUBSTRINGS\n" ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    SUBSTRINGS\n", 0, 0, 0 );
 #endif
@@ -119,8 +119,8 @@ test_filter(
 
        case LDAP_FILTER_PRESENT:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter:    PRESENT\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter:        PRESENT\n" ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    PRESENT\n", 0, 0, 0 );
 #endif
@@ -130,8 +130,8 @@ test_filter(
 
        case LDAP_FILTER_APPROX:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter: APPROX\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter: APPROX\n" ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    APPROX\n", 0, 0, 0 );
 #endif
@@ -141,10 +141,10 @@ test_filter(
 
        case LDAP_FILTER_AND:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter:  AND\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter:  AND\n" ));
 #else
-                Debug( LDAP_DEBUG_FILTER, "    AND\n", 0, 0, 0 );
+               Debug( LDAP_DEBUG_FILTER, "    AND\n", 0, 0, 0 );
 #endif
 
                rc = test_filter_and( be, conn, op, e, f->f_and );
@@ -152,8 +152,8 @@ test_filter(
 
        case LDAP_FILTER_OR:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter:    OR\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter:        OR\n" ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    OR\n", 0, 0, 0 );
 #endif
@@ -163,14 +163,17 @@ test_filter(
 
        case LDAP_FILTER_NOT:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter:    NOT\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter:        NOT\n" ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    NOT\n", 0, 0, 0 );
 #endif
 
                rc = test_filter( be, conn, op, e, f->f_not );
 
+               /* Flip true to false and false to true
+                * but leave Undefined alone.
+                */
                switch( rc ) {
                case LDAP_COMPARE_TRUE:
                        rc = LDAP_COMPARE_FALSE;
@@ -181,24 +184,22 @@ test_filter(
                }
                break;
 
-#ifdef SLAPD_EXT_FILTERS
        case LDAP_FILTER_EXT:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
-                       "test_filter:    EXT\n" ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_DETAIL1,
+                          "test_filter:        EXT\n" ));
 #else
                Debug( LDAP_DEBUG_FILTER, "    EXT\n", 0, 0, 0 );
 #endif
 
                rc = test_mra_filter( be, conn, op, e, f->f_mra );
                break;
-#endif
 
        default:
 #ifdef NEW_LOGGING
-            LDAP_LOG(( "filter", LDAP_LEVEL_INFO,
-                       "test_filter:  unknown filter type %lu\n", 
-                       f->f_choice ));
+               LDAP_LOG(( "filter", LDAP_LEVEL_INFO,
+                          "test_filter:  unknown filter type %lu\n", 
+                      f->f_choice ));
 #else
                Debug( LDAP_DEBUG_ANY, "    unknown filter type %lu\n",
                    f->f_choice, 0, 0 );
@@ -208,8 +209,8 @@ test_filter(
        }
 
 #ifdef NEW_LOGGING
-        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_filter:  return=%d\n", rc ));
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "test_filter:  return=%d\n", rc ));
 #else
        Debug( LDAP_DEBUG_FILTER, "<= test_filter %d\n", rc, 0, 0 );
 #endif
@@ -217,6 +218,58 @@ test_filter(
        return( rc );
 }
 
+static int test_mra_filter(
+       Backend *be,
+       Connection *conn,
+       Operation *op,
+       Entry *e,
+       MatchingRuleAssertion *mra )
+{
+       int             i;
+       Attribute       *a;
+
+       if( !access_allowed( be, conn, op, e,
+               mra->ma_desc, mra->ma_value, ACL_SEARCH ) )
+       {
+               return LDAP_INSUFFICIENT_ACCESS;
+       }
+
+       if( strcmp(mra->ma_rule->smr_syntax->ssyn_oid,
+               mra->ma_desc->ad_type->sat_syntax->ssyn_oid) != 0)
+       {
+               return LDAP_INVALID_SYNTAX;
+       }
+
+       if( mra->ma_rule == NULL )
+       {
+               return LDAP_INAPPROPRIATE_MATCHING;
+       }
+
+       for(a = attrs_find( e->e_attrs, mra->ma_desc );
+               a != NULL;
+               a = attrs_find( a->a_next, mra->ma_desc ) )
+       {
+               for ( i = 0; a->a_vals[i] != NULL; i++ ) {
+                       int ret;
+                       int rc;
+                       const char *text;
+
+                       rc = value_match( &ret, a->a_desc, mra->ma_rule, 0,
+                               a->a_vals[i], mra->ma_value,
+                               &text );
+
+                       if( rc != LDAP_SUCCESS ) {
+                               return rc;
+                       }
+
+                       if ( ret ) {
+                               return LDAP_COMPARE_TRUE;
+                       }
+               }
+       }
+
+       return LDAP_COMPARE_FALSE;
+}
 
 static int
 test_ava_filter(
@@ -231,7 +284,7 @@ test_ava_filter(
        int             i;
        Attribute       *a;
 
-       if ( be != NULL && ! access_allowed( be, conn, op, e,
+       if ( !access_allowed( be, conn, op, e,
                ava->aa_desc, ava->aa_value, ACL_SEARCH ) )
        {
                return LDAP_INSUFFICIENT_ACCESS;
@@ -316,8 +369,7 @@ test_presence_filter(
        AttributeDescription *desc
 )
 {
-       if ( be != NULL && ! access_allowed( be, conn, op, e,
-               desc, NULL, ACL_SEARCH ) )
+       if ( !access_allowed( be, conn, op, e, desc, NULL, ACL_SEARCH ) )
        {
                return LDAP_INSUFFICIENT_ACCESS;
        }
@@ -337,11 +389,11 @@ test_filter_and(
 )
 {
        Filter  *f;
-       int rtn = LDAP_COMPARE_TRUE;
+       int rtn = LDAP_COMPARE_TRUE; /* True if empty */
 
 #ifdef NEW_LOGGING
-        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_filter_and: begin\n" ));
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "test_filter_and: begin\n" ));
 #else
        Debug( LDAP_DEBUG_FILTER, "=> test_filter_and\n", 0, 0, 0 );
 #endif
@@ -351,17 +403,20 @@ test_filter_and(
                int rc = test_filter( be, conn, op, e, f );
 
                if ( rc == LDAP_COMPARE_FALSE ) {
-                       rtn = LDAP_COMPARE_FALSE;
+                       /* filter is False */
+                       rtn = rc;
                        break;
                }
+
                if ( rc != LDAP_COMPARE_TRUE ) {
+                       /* filter is Undefined unless later elements are False */
                        rtn = rc;
                }
        }
 
 #ifdef NEW_LOGGING
-        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_filter_and:  rc=%d\n", rtn ));
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "test_filter_and:  rc=%d\n", rtn ));
 #else
        Debug( LDAP_DEBUG_FILTER, "<= test_filter_and %d\n", rtn, 0, 0 );
 #endif
@@ -379,11 +434,11 @@ test_filter_or(
 )
 {
        Filter  *f;
-       int rtn = LDAP_COMPARE_FALSE;
+       int rtn = LDAP_COMPARE_FALSE; /* False if empty */
 
 #ifdef NEW_LOGGING
-        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_filter_or: begin\n" ));
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "test_filter_or: begin\n" ));
 #else
        Debug( LDAP_DEBUG_FILTER, "=> test_filter_or\n", 0, 0, 0 );
 #endif
@@ -393,17 +448,20 @@ test_filter_or(
                int rc = test_filter( be, conn, op, e, f );
 
                if ( rc == LDAP_COMPARE_TRUE ) {
-                       rtn = LDAP_COMPARE_TRUE;
+                       /* filter is True */
+                       rtn = rc;
                        break;
                }
-               if ( rc != LDAP_COMPARE_TRUE ) {
+
+               if ( rc != LDAP_COMPARE_FALSE ) {
+                       /* filter is Undefined unless later elements are True */
                        rtn = rc;
                }
        }
 
 #ifdef NEW_LOGGING
-        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_filter_or: result=%d\n", rtn ));
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "test_filter_or: result=%d\n", rtn ));
 #else
        Debug( LDAP_DEBUG_FILTER, "<= test_filter_or %d\n", rtn, 0, 0 );
 #endif
@@ -424,14 +482,14 @@ test_substrings_filter(
        Attribute       *a;
 
 #ifdef NEW_LOGGING
-        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_substrings_filter: begin\n" ));
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "test_substrings_filter: begin\n" ));
 #else
        Debug( LDAP_DEBUG_FILTER, "begin test_substrings_filter\n", 0, 0, 0 );
 #endif
 
 
-       if ( be != NULL && ! access_allowed( be, conn, op, e,
+       if ( !access_allowed( be, conn, op, e,
                f->f_sub_desc, NULL, ACL_SEARCH ) )
        {
                return LDAP_INSUFFICIENT_ACCESS;
@@ -468,8 +526,8 @@ test_substrings_filter(
        }
 
 #ifdef NEW_LOGGING
-        LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
-                   "test_substrings_filter: return FALSE\n" ));
+       LDAP_LOG(( "filter", LDAP_LEVEL_ENTRY,
+                  "test_substrings_filter: return FALSE\n" ));
 #else
        Debug( LDAP_DEBUG_FILTER, "end test_substrings_filter 1\n", 0, 0, 0 );
 #endif