X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Ffilterentry.c;h=fc090eb3fc977a3a4d71fc54a84e4dac0f75305c;hb=20965abe9c5bb80d79e5ad791cd2b59ec60259b5;hp=3cf1d88f2251d941b6769b23d5eb7a86a2634b4a;hpb=76bf91f553d9630e633f6bb92fe5a093da9e2e6d;p=openldap diff --git a/servers/slapd/filterentry.c b/servers/slapd/filterentry.c index 3cf1d88f22..fc090eb3fc 100644 --- a/servers/slapd/filterentry.c +++ b/servers/slapd/filterentry.c @@ -1,8 +1,27 @@ /* filterentry.c - apply a filter to an entry */ /* $OpenLDAP$ */ -/* - * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved. - * COPYING RESTRICTIONS APPLY, see COPYRIGHT file +/* This work is part of OpenLDAP Software . + * + * Copyright 1998-2004 The OpenLDAP Foundation. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted only as authorized by the OpenLDAP + * Public License. + * + * A copy of this license is available in the file LICENSE in the + * top-level directory of the distribution or, alternatively, at + * . + */ +/* Portions Copyright (c) 1995 Regents of the University of Michigan. + * All rights reserved. + * + * Redistribution and use in source and binary forms are permitted + * provided that this notice is preserved and that due credit is given + * to the University of Michigan at Ann Arbor. The name of the University + * may not be used to endorse or promote products derived from this + * software without specific prior written permission. This software + * is provided ``as is'' without express or implied warranty. */ #include "portable.h" @@ -15,23 +34,14 @@ #include "slap.h" -static int test_filter_and( Backend *be, - Connection *conn, Operation *op, - Entry *e, Filter *flist ); -static int test_filter_or( Backend *be, - Connection *conn, Operation *op, - Entry *e, Filter *flist ); -static int test_substrings_filter( Backend *be, - Connection *conn, Operation *op, - Entry *e, Filter *f); -static int test_ava_filter( Backend *be, - Connection *conn, Operation *op, +static int test_filter_and( Operation *op, Entry *e, Filter *flist ); +static int test_filter_or( Operation *op, Entry *e, Filter *flist ); +static int test_substrings_filter( Operation *op, Entry *e, Filter *f); +static int test_ava_filter( Operation *op, Entry *e, AttributeAssertion *ava, int type ); -static int test_mra_filter( Backend *be, - Connection *conn, Operation *op, +static int test_mra_filter( Operation *op, Entry *e, MatchingRuleAssertion *mra ); -static int test_presence_filter( Backend *be, - Connection *conn, Operation *op, +static int test_presence_filter( Operation *op, Entry *e, AttributeDescription *desc ); @@ -46,121 +56,67 @@ static int test_presence_filter( Backend *be, int test_filter( - Backend *be, - Connection *conn, Operation *op, Entry *e, - Filter *f -) + Filter *f ) { int rc; - -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, ENTRY, "test_filter: begin\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, "=> test_filter\n", 0, 0, 0 ); -#endif - switch ( f->f_choice ) { case SLAPD_FILTER_COMPUTED: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, - "test_filter: COMPUTED %s (%d)\n", - f->f_result == LDAP_COMPARE_FALSE ? "false" : - f->f_result == LDAP_COMPARE_TRUE ? "true" : - f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" : - "error", f->f_result, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " COMPUTED %s (%d)\n", f->f_result == LDAP_COMPARE_FALSE ? "false" : f->f_result == LDAP_COMPARE_TRUE ? "true" : f->f_result == SLAPD_COMPARE_UNDEFINED ? "undefined" : "error", f->f_result, 0 ); -#endif rc = f->f_result; break; case LDAP_FILTER_EQUALITY: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter: EQUALITY\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " EQUALITY\n", 0, 0, 0 ); -#endif - - rc = test_ava_filter( be, conn, op, e, f->f_ava, - LDAP_FILTER_EQUALITY ); + rc = test_ava_filter( op, e, f->f_ava, LDAP_FILTER_EQUALITY ); break; case LDAP_FILTER_SUBSTRINGS: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter SUBSTRINGS\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " SUBSTRINGS\n", 0, 0, 0 ); -#endif - - rc = test_substrings_filter( be, conn, op, e, f ); + rc = test_substrings_filter( op, e, f ); break; case LDAP_FILTER_GE: - rc = test_ava_filter( be, conn, op, e, f->f_ava, - LDAP_FILTER_GE ); + Debug( LDAP_DEBUG_FILTER, " GE\n", 0, 0, 0 ); + rc = test_ava_filter( op, e, f->f_ava, LDAP_FILTER_GE ); break; case LDAP_FILTER_LE: - rc = test_ava_filter( be, conn, op, e, f->f_ava, - LDAP_FILTER_LE ); + Debug( LDAP_DEBUG_FILTER, " LE\n", 0, 0, 0 ); + rc = test_ava_filter( op, e, f->f_ava, LDAP_FILTER_LE ); break; case LDAP_FILTER_PRESENT: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter: PRESENT\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " PRESENT\n", 0, 0, 0 ); -#endif - - rc = test_presence_filter( be, conn, op, e, f->f_desc ); + rc = test_presence_filter( op, e, f->f_desc ); break; case LDAP_FILTER_APPROX: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter: APPROX\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " APPROX\n", 0, 0, 0 ); -#endif - rc = test_ava_filter( be, conn, op, e, f->f_ava, - LDAP_FILTER_APPROX ); + rc = test_ava_filter( op, e, f->f_ava, LDAP_FILTER_APPROX ); break; case LDAP_FILTER_AND: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter: AND\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " AND\n", 0, 0, 0 ); -#endif - - rc = test_filter_and( be, conn, op, e, f->f_and ); + rc = test_filter_and( op, e, f->f_and ); break; case LDAP_FILTER_OR: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter: OR\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " OR\n", 0, 0, 0 ); -#endif - - rc = test_filter_or( be, conn, op, e, f->f_or ); + rc = test_filter_or( op, e, f->f_or ); break; case LDAP_FILTER_NOT: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter: NOT\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " NOT\n", 0, 0, 0 ); -#endif - - rc = test_filter( be, conn, op, e, f->f_not ); + rc = test_filter( op, e, f->f_not ); /* Flip true to false and false to true * but leave Undefined alone. @@ -176,44 +132,36 @@ test_filter( break; case LDAP_FILTER_EXT: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, DETAIL1, "test_filter: EXT\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, " EXT\n", 0, 0, 0 ); -#endif - - rc = test_mra_filter( be, conn, op, e, f->f_mra ); + rc = test_mra_filter( op, e, f->f_mra ); break; default: -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, INFO, - "test_filter: unknown filter type %lu\n", f->f_choice, 0, 0 ); -#else Debug( LDAP_DEBUG_ANY, " unknown filter type %lu\n", f->f_choice, 0, 0 ); -#endif - rc = LDAP_PROTOCOL_ERROR; } -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, RESULTS, "test_filter: return=%d\n", rc, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, "<= test_filter %d\n", rc, 0, 0 ); -#endif - return( rc ); } static int test_mra_filter( - Backend *be, - Connection *conn, Operation *op, Entry *e, MatchingRuleAssertion *mra ) { Attribute *a; + void *memctx; + BER_MEMFREE_FN *memfree; + + if ( op == NULL ) { + memctx = NULL; + memfree = slap_sl_free; + } else { + memctx = op->o_tmpmemctx; + memfree = op->o_tmpfree; + } if ( mra->ma_desc ) { /* @@ -221,37 +169,63 @@ static int test_mra_filter( * one attribute, and SEARCH permissions can be checked * directly. */ - if( !access_allowed( be, conn, op, e, + if( !access_allowed( op, e, mra->ma_desc, &mra->ma_value, ACL_SEARCH, NULL ) ) { return LDAP_INSUFFICIENT_ACCESS; } + if ( mra->ma_desc == slap_schema.si_ad_entryDN ) { + int ret, rc; + const char *text; + + rc = value_match( &ret, slap_schema.si_ad_entryDN, mra->ma_rule, + 0, &e->e_nname, &mra->ma_value, &text ); + + + if( rc != LDAP_SUCCESS ) return rc; + if ( ret == 0 ) return LDAP_COMPARE_TRUE; + return LDAP_COMPARE_FALSE; + } + for(a = attrs_find( e->e_attrs, mra->ma_desc ); a != NULL; a = attrs_find( a->a_next, mra->ma_desc ) ) { struct berval *bv; - for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) { + /* If ma_rule is not the same as the attribute's + * normal rule, then we can't use the a_nvals. + */ + if (mra->ma_rule == a->a_desc->ad_type->sat_equality) { + bv = a->a_nvals; + } else { + bv = a->a_vals; + } + + for ( ; bv->bv_val != NULL; bv++ ) { int ret; int rc; const char *text; - rc = value_match( &ret, a->a_desc, mra->ma_rule, - SLAP_MR_ASSERTION_SYNTAX_MATCH, +#ifdef LDAP_COMP_MATCH + /* Component Matching */ + if( mra->ma_cf && mra->ma_rule->smr_usage & SLAP_MR_COMPONENT ) { + rc = value_match( &ret, a->a_desc, mra->ma_rule, 0, + (struct berval *)a,(void*) mra , &text ); + } + else { +#endif + rc = value_match( &ret, a->a_desc, mra->ma_rule, 0, bv, &mra->ma_value, &text ); - - if( rc != LDAP_SUCCESS ) { - return rc; - } - - if ( ret == 0 ) { - return LDAP_COMPARE_TRUE; - } +#ifdef LDAP_COMP_MATCH + } +#endif + if( rc != LDAP_SUCCESS ) return rc; + if ( ret == 0 ) return LDAP_COMPARE_TRUE; } } - } else { + } else { /* * No attribute description: test all */ @@ -266,61 +240,77 @@ static int test_mra_filter( } /* normalize for equality */ - rc = value_validate_normalize( a->a_desc, - SLAP_MR_EQUALITY, - &mra->ma_value, &value, &text ); - if ( rc != LDAP_SUCCESS ) { - continue; - } + rc = asserted_value_validate_normalize( a->a_desc, mra->ma_rule, + SLAP_MR_EXT|SLAP_MR_VALUE_OF_ASSERTION_SYNTAX, + &mra->ma_value, &value, &text, memctx ); + if ( rc != LDAP_SUCCESS ) continue; /* check search access */ - if ( !access_allowed( be, conn, op, e, + if ( !access_allowed( op, e, a->a_desc, &value, ACL_SEARCH, NULL ) ) { + memfree( value.bv_val, memctx ); continue; } /* check match */ - for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) { + if (mra->ma_rule == a->a_desc->ad_type->sat_equality) { + bv = a->a_nvals; + } else { + bv = a->a_vals; + } + + for ( ; bv->bv_val != NULL; bv++ ) { int ret; - int rc; - rc = value_match( &ret, a->a_desc, mra->ma_rule, - SLAP_MR_ASSERTION_SYNTAX_MATCH, +#ifdef LDAP_COMP_MATCH + /* Component Matching */ + if( mra->ma_cf && + mra->ma_rule->smr_usage & SLAP_MR_COMPONENT) { + rc = value_match( &ret, a->a_desc, mra->ma_rule, 0, + (struct berval*)a, (void*)mra, &text ); + } + else { +#endif + rc = value_match( &ret, a->a_desc, mra->ma_rule, 0, bv, &value, &text ); - if( rc != LDAP_SUCCESS ) { - return rc; - } +#ifdef LDAP_COMP_MATCH + } +#endif + if( rc != LDAP_SUCCESS ) break; if ( ret == 0 ) { - return LDAP_COMPARE_TRUE; + rc = LDAP_COMPARE_TRUE; + break; } } + memfree( value.bv_val, memctx ); + if ( rc != LDAP_SUCCESS ) return rc; } } /* check attrs in DN AVAs if required */ if ( mra->ma_dnattrs ) { - LDAPDN *dn = NULL; + LDAPDN dn = NULL; int iRDN, iAVA; int rc; /* parse and pretty the dn */ - rc = dnPrettyDN( NULL, &e->e_name, &dn ); + rc = dnPrettyDN( NULL, &e->e_name, &dn, memctx ); if ( rc != LDAP_SUCCESS ) { return LDAP_INVALID_SYNTAX; } /* for each AVA of each RDN ... */ - for ( iRDN = 0; dn[ 0 ][ iRDN ]; iRDN++ ) { - LDAPRDN *rdn = dn[ 0 ][ iRDN ]; + for ( iRDN = 0; dn[ iRDN ]; iRDN++ ) { + LDAPRDN rdn = dn[ iRDN ]; - for ( iAVA = 0; rdn[ 0 ][ iAVA ]; iAVA++ ) { - LDAPAVA *ava = rdn[ 0 ][ iAVA ]; + for ( iAVA = 0; rdn[ iAVA ]; iAVA++ ) { + LDAPAVA *ava = rdn[ iAVA ]; struct berval *bv = &ava->la_value, value; - AttributeDescription *ad = (AttributeDescription *)ava->la_private; + AttributeDescription *ad = + (AttributeDescription *)ava->la_private; int ret; - int rc; const char *text; assert( ad ); @@ -341,35 +331,37 @@ static int test_mra_filter( } /* normalize for equality */ - rc = value_validate_normalize( ad, SLAP_MR_EQUALITY, - &mra->ma_value, &value, &text ); - if ( rc != LDAP_SUCCESS ) { - continue; - } + rc = asserted_value_validate_normalize( ad, + mra->ma_rule, + SLAP_MR_EXT|SLAP_MR_VALUE_OF_ASSERTION_SYNTAX, + &mra->ma_value, &value, &text, memctx ); + if ( rc != LDAP_SUCCESS ) continue; /* check search access */ - if ( !access_allowed( be, conn, op, e, - ad, &value, ACL_SEARCH, NULL ) ) { + if ( !access_allowed( op, e, + ad, &value, ACL_SEARCH, NULL ) ) + { + memfree( value.bv_val, memctx ); continue; } } /* check match */ - rc = value_match( &ret, ad, mra->ma_rule, - SLAP_MR_ASSERTION_SYNTAX_MATCH, + rc = value_match( &ret, ad, mra->ma_rule, 0, bv, &value, &text ); + if ( value.bv_val != mra->ma_value.bv_val ) { + memfree( value.bv_val, memctx ); + } + + if ( rc == LDAP_SUCCESS && ret == 0 ) rc = LDAP_COMPARE_TRUE; if( rc != LDAP_SUCCESS ) { - ldap_dnfree( dn ); + ldap_dnfree_x( dn, memctx ); return rc; } - - if ( ret == 0 ) { - ldap_dnfree( dn ); - return LDAP_COMPARE_TRUE; - } } } + ldap_dnfree_x( dn, memctx ); } return LDAP_COMPARE_FALSE; @@ -377,22 +369,78 @@ static int test_mra_filter( static int test_ava_filter( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, + Operation *op, + Entry *e, AttributeAssertion *ava, - int type -) + int type ) { + int rc; Attribute *a; - if ( !access_allowed( be, conn, op, e, + if ( !access_allowed( op, e, ava->aa_desc, &ava->aa_value, ACL_SEARCH, NULL ) ) { return LDAP_INSUFFICIENT_ACCESS; } + if ( ava->aa_desc == slap_schema.si_ad_hasSubordinates + && op && op->o_bd && op->o_bd->be_has_subordinates ) + { + int hasSubordinates; + struct berval hs; + + if( type != LDAP_FILTER_EQUALITY && + type != LDAP_FILTER_APPROX ) + { + /* No other match is allowed */ + return LDAP_INAPPROPRIATE_MATCHING; + } + + if ( op->o_bd->be_has_subordinates( op, e, &hasSubordinates ) != + LDAP_SUCCESS ) + { + return LDAP_OTHER; + } + + if ( hasSubordinates == LDAP_COMPARE_TRUE ) { + hs = slap_true_bv; + + } else if ( hasSubordinates == LDAP_COMPARE_FALSE ) { + hs = slap_false_bv; + + } else { + return LDAP_OTHER; + } + + if ( bvmatch( &ava->aa_value, &hs ) ) return LDAP_COMPARE_TRUE; + return LDAP_COMPARE_FALSE; + } + + if ( ava->aa_desc == slap_schema.si_ad_entryDN ) { + MatchingRule *mr; + int rc, match; + const char *text; + + if( type != LDAP_FILTER_EQUALITY && + type != LDAP_FILTER_APPROX ) + { + /* No other match is allowed */ + return LDAP_INAPPROPRIATE_MATCHING; + } + + mr = slap_schema.si_ad_entryDN->ad_type->sat_equality; + assert( mr ); + + rc = value_match( &match, slap_schema.si_ad_entryDN, mr, 0, + &e->e_nname, &ava->aa_value, &text ); + + if( rc != LDAP_SUCCESS ) return rc; + if( match == 0 ) return LDAP_COMPARE_TRUE; + return LDAP_COMPARE_FALSE; + } + + rc = LDAP_COMPARE_FALSE; + for(a = attrs_find( e->e_attrs, ava->aa_desc ); a != NULL; a = attrs_find( a->a_next, ava->aa_desc ) ) @@ -400,6 +448,13 @@ test_ava_filter( MatchingRule *mr; struct berval *bv; + if (( ava->aa_desc != a->a_desc ) && !access_allowed( op, + e, a->a_desc, &ava->aa_value, ACL_SEARCH, NULL )) + { + rc = LDAP_INSUFFICIENT_ACCESS; + continue; + } + switch ( type ) { case LDAP_FILTER_APPROX: mr = a->a_desc->ad_type->sat_approx; @@ -421,140 +476,111 @@ test_ava_filter( } if( mr == NULL ) { + rc = LDAP_INAPPROPRIATE_MATCHING; continue; } - for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) { - int ret; - int rc; + for ( bv = a->a_nvals; bv->bv_val != NULL; bv++ ) { + int ret, match; const char *text; - rc = value_match( &ret, a->a_desc, mr, - SLAP_MR_ASSERTION_SYNTAX_MATCH, + ret = value_match( &match, a->a_desc, mr, 0, bv, &ava->aa_value, &text ); - if( rc != LDAP_SUCCESS ) { - return rc; + if( ret != LDAP_SUCCESS ) { + rc = ret; + break; } switch ( type ) { case LDAP_FILTER_EQUALITY: case LDAP_FILTER_APPROX: - if ( ret == 0 ) { - return LDAP_COMPARE_TRUE; - } + if ( match == 0 ) return LDAP_COMPARE_TRUE; break; case LDAP_FILTER_GE: - if ( ret >= 0 ) { - return LDAP_COMPARE_TRUE; - } + if ( match >= 0 ) return LDAP_COMPARE_TRUE; break; case LDAP_FILTER_LE: - if ( ret <= 0 ) { - return LDAP_COMPARE_TRUE; - } + if ( match <= 0 ) return LDAP_COMPARE_TRUE; break; } } } - if ( ava->aa_desc == slap_schema.si_ad_hasSubordinates - && be && be->be_has_subordinates ) { - int hasSubordinates; - struct berval hs; - - /* - * No other match should be allowed ... - */ - assert( type == LDAP_FILTER_EQUALITY ); - - if ( (*be->be_has_subordinates)( be, conn, op, e, &hasSubordinates ) ) { - return LDAP_OTHER; - } - - if ( hasSubordinates == LDAP_COMPARE_TRUE ) { - hs.bv_val = "TRUE"; - hs.bv_len = sizeof( "TRUE" ) - 1; - - } else if ( hasSubordinates == LDAP_COMPARE_FALSE ) { - hs.bv_val = "FALSE"; - hs.bv_len = sizeof( "FALSE" ) - 1; - - } else { - return LDAP_OTHER; - } - - if ( bvmatch( &ava->aa_value, &hs ) ) { - return LDAP_COMPARE_TRUE; - } - - return LDAP_COMPARE_FALSE; - } - - return( LDAP_COMPARE_FALSE ); + return rc; } static int test_presence_filter( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - AttributeDescription *desc -) + Operation *op, + Entry *e, + AttributeDescription *desc ) { Attribute *a; + int rc; - if ( !access_allowed( be, conn, op, e, desc, NULL, ACL_SEARCH, NULL ) ) - { + if ( !access_allowed( op, e, desc, NULL, ACL_SEARCH, NULL ) ) { return LDAP_INSUFFICIENT_ACCESS; } - a = attrs_find( e->e_attrs, desc ); - - if ( a == NULL && desc == slap_schema.si_ad_hasSubordinates ) { - + if ( desc == slap_schema.si_ad_hasSubordinates ) { /* * XXX: fairly optimistic: if the function is defined, * then PRESENCE must succeed, because hasSubordinate * is boolean-valued; I think we may live with this * simplification by now */ - if ( be && be->be_has_subordinates ) { + if ( op && op->o_bd && op->o_bd->be_has_subordinates ) { return LDAP_COMPARE_TRUE; } return LDAP_COMPARE_FALSE; } - return a != NULL ? LDAP_COMPARE_TRUE : LDAP_COMPARE_FALSE; + if ( desc == slap_schema.si_ad_entryDN || + desc == slap_schema.si_ad_subschemaSubentry ) + { + /* entryDN and subschemaSubentry are always present */ + return LDAP_COMPARE_TRUE; + } + + rc = LDAP_COMPARE_FALSE; + + for(a = attrs_find( e->e_attrs, desc ); + a != NULL; + a = attrs_find( a->a_next, desc ) ) + { + if (( desc != a->a_desc ) && !access_allowed( op, + e, a->a_desc, NULL, ACL_SEARCH, NULL )) + { + rc = LDAP_INSUFFICIENT_ACCESS; + continue; + } + + rc = LDAP_COMPARE_TRUE; + break; + } + + return rc; } static int test_filter_and( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - Filter *flist -) + Operation *op, + Entry *e, + Filter *flist ) { Filter *f; int rtn = LDAP_COMPARE_TRUE; /* True if empty */ -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, ENTRY, "test_filter_and: begin\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, "=> test_filter_and\n", 0, 0, 0 ); -#endif - for ( f = flist; f != NULL; f = f->f_next ) { - int rc = test_filter( be, conn, op, e, f ); + int rc = test_filter( op, e, f ); if ( rc == LDAP_COMPARE_FALSE ) { /* filter is False */ @@ -568,36 +594,24 @@ test_filter_and( } } -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, RESULTS, "test_filter_and: rc=%d\n", rtn, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, "<= test_filter_and %d\n", rtn, 0, 0 ); -#endif return rtn; } static int test_filter_or( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - Filter *flist -) + Operation *op, + Entry *e, + Filter *flist ) { Filter *f; int rtn = LDAP_COMPARE_FALSE; /* False if empty */ -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, ENTRY, "test_filter_or: begin\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, "=> test_filter_or\n", 0, 0, 0 ); -#endif - for ( f = flist; f != NULL; f = f->f_next ) { - int rc = test_filter( be, conn, op, e, f ); + int rc = test_filter( op, e, f ); if ( rc == LDAP_COMPARE_TRUE ) { /* filter is True */ @@ -611,75 +625,66 @@ test_filter_or( } } -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, ENTRY, "test_filter_or: result=%d\n", rtn, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, "<= test_filter_or %d\n", rtn, 0, 0 ); -#endif - return rtn; } static int test_substrings_filter( - Backend *be, - Connection *conn, - Operation *op, - Entry *e, - Filter *f -) + Operation *op, + Entry *e, + Filter *f ) { Attribute *a; + int rc; -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, ENTRY, "test_substrings_filter: begin\n", 0, 0, 0 ); -#else Debug( LDAP_DEBUG_FILTER, "begin test_substrings_filter\n", 0, 0, 0 ); -#endif - - if ( !access_allowed( be, conn, op, e, + if ( !access_allowed( op, e, f->f_sub_desc, NULL, ACL_SEARCH, NULL ) ) { return LDAP_INSUFFICIENT_ACCESS; } + rc = LDAP_COMPARE_FALSE; + for(a = attrs_find( e->e_attrs, f->f_sub_desc ); a != NULL; a = attrs_find( a->a_next, f->f_sub_desc ) ) { - MatchingRule *mr = a->a_desc->ad_type->sat_substr; + MatchingRule *mr; struct berval *bv; + if (( f->f_sub_desc != a->a_desc ) && !access_allowed( op, + e, a->a_desc, NULL, ACL_SEARCH, NULL )) + { + rc = LDAP_INSUFFICIENT_ACCESS; + continue; + } + + mr = a->a_desc->ad_type->sat_substr; if( mr == NULL ) { + rc = LDAP_INAPPROPRIATE_MATCHING; continue; } - for ( bv = a->a_vals; bv->bv_val != NULL; bv++ ) { - int ret; - int rc; + for ( bv = a->a_nvals; bv->bv_val != NULL; bv++ ) { + int ret, match; const char *text; - rc = value_match( &ret, a->a_desc, mr, - SLAP_MR_ASSERTION_SYNTAX_MATCH, + ret = value_match( &match, a->a_desc, mr, 0, bv, f->f_sub, &text ); - if( rc != LDAP_SUCCESS ) { - return rc; - } - - if ( ret == 0 ) { - return LDAP_COMPARE_TRUE; + if( ret != LDAP_SUCCESS ) { + rc = ret; + break; } + if ( match == 0 ) return LDAP_COMPARE_TRUE; } } -#ifdef NEW_LOGGING - LDAP_LOG( FILTER, ENTRY, "test_substrings_filter: return FALSE\n", 0, 0, 0 ); -#else - Debug( LDAP_DEBUG_FILTER, "end test_substrings_filter 1\n", 0, 0, 0 ); -#endif - - return LDAP_COMPARE_FALSE; + Debug( LDAP_DEBUG_FILTER, "end test_substrings_filter %d\n", + rc, 0, 0 ); + return rc; }