X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Flimits.c;h=6026218c53a493cef13c57daf165d56aea162e3a;hb=c7305c4133eca44f2cf10f8b5f11dcfc0c1ff98b;hp=291824ac95f282c99a919ea0962f0142ae7a025b;hpb=c7e89d57bee9093739a21ffb46461241d8477591;p=openldap diff --git a/servers/slapd/limits.c b/servers/slapd/limits.c index 291824ac95..6026218c53 100644 --- a/servers/slapd/limits.c +++ b/servers/slapd/limits.c @@ -2,7 +2,7 @@ /* $OpenLDAP$ */ /* This work is part of OpenLDAP Software . * - * Copyright 1998-2004 The OpenLDAP Foundation. + * Copyright 1998-2010 The OpenLDAP Foundation. * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -18,23 +18,70 @@ #include +#include #include #include #include "slap.h" +#include "lutil.h" + +/* define to get an error if requesting limit higher than hard */ +#undef ABOVE_HARD_LIMIT_IS_ERROR + +static const struct berval lmpats[] = { + BER_BVC( "base" ), + BER_BVC( "base" ), + BER_BVC( "onelevel" ), + BER_BVC( "subtree" ), + BER_BVC( "children" ), + BER_BVC( "regex" ), + BER_BVC( "anonymous" ), + BER_BVC( "users" ), + BER_BVC( "*" ) +}; + +#ifdef LDAP_DEBUG +static const char *const dn_source[2] = { "DN", "DN.THIS" }; +static const char *const lmpats_out[] = { + "UNDEFINED", + "EXACT", + "ONELEVEL", + "SUBTREE", + "CHILDREN", + "REGEX", + "ANONYMOUS", + "USERS", + "ANY" +}; + +static const char * +limits2str( unsigned i ) +{ + return i < (sizeof( lmpats_out ) / sizeof( lmpats_out[0] )) + ? lmpats_out[i] : "UNKNOWN"; +} +#endif /* LDAP_DEBUG */ -int +static int limits_get( Operation *op, - struct berval *ndn, struct slap_limits_set **limit ) { + static struct berval empty_dn = BER_BVC( "" ); struct slap_limits **lm; + struct berval *ndns[2]; + + assert( op != NULL ); + assert( limit != NULL ); - assert( op ); - assert( limit ); + ndns[0] = &op->o_ndn; + ndns[1] = &op->o_req_ndn; + Debug( LDAP_DEBUG_TRACE, "==> limits_get: %s self=\"%s\" this=\"%s\"\n", + op->o_log_prefix, + BER_BVISNULL( ndns[0] ) ? "[anonymous]" : ndns[0]->bv_val, + BER_BVISNULL( ndns[1] ) ? "" : ndns[1]->bv_val ); /* * default values */ @@ -47,111 +94,105 @@ limits_get( for ( lm = op->o_bd->be_limits; lm[0] != NULL; lm++ ) { unsigned style = lm[0]->lm_flags & SLAP_LIMITS_MASK; unsigned type = lm[0]->lm_flags & SLAP_LIMITS_TYPE_MASK; + unsigned isthis = type == SLAP_LIMITS_TYPE_THIS; + struct berval *ndn = ndns[isthis]; + + if ( style == SLAP_LIMITS_ANY ) + goto found_any; + + if ( BER_BVISEMPTY( ndn ) ) { + if ( style == SLAP_LIMITS_ANONYMOUS ) + goto found_nodn; + if ( !isthis ) + continue; + ndn = &empty_dn; + } switch ( style ) { case SLAP_LIMITS_EXACT: - if ( ndn->bv_len == 0 ) { - break; - } - if ( type == SLAP_LIMITS_TYPE_GROUP ) { - int rc; - - rc = backend_group( op, NULL, + int rc = backend_group( op, NULL, &lm[0]->lm_pat, ndn, lm[0]->lm_group_oc, lm[0]->lm_group_ad ); if ( rc == 0 ) { - *limit = &lm[0]->lm_limits; - return( 0 ); + goto found_group; + } + } else { + if ( dn_match( &lm[0]->lm_pat, ndn ) ) { + goto found_dn; } - } - - if ( dn_match( &lm[0]->lm_pat, ndn ) ) { - *limit = &lm[0]->lm_limits; - return( 0 ); } break; case SLAP_LIMITS_ONE: case SLAP_LIMITS_SUBTREE: case SLAP_LIMITS_CHILDREN: { - size_t d; + ber_len_t d; - if ( ndn->bv_len == 0 ) { - break; - } - - /* ndn shorter than dn_pat */ + /* ndn shorter than lm_pat */ if ( ndn->bv_len < lm[0]->lm_pat.bv_len ) { break; } d = ndn->bv_len - lm[0]->lm_pat.bv_len; - /* allow exact match for SUBTREE only */ if ( d == 0 ) { + /* allow exact match for SUBTREE only */ if ( style != SLAP_LIMITS_SUBTREE ) { break; } } else { /* check for unescaped rdn separator */ - if ( !DN_SEPARATOR( ndn->bv_val[d-1] ) ) { + if ( !DN_SEPARATOR( ndn->bv_val[d - 1] ) ) { break; } } - /* in case of (sub)match ... */ - if ( lm[0]->lm_pat.bv_len == ( ndn->bv_len - d ) - && strcmp( lm[0]->lm_pat.bv_val, - &ndn->bv_val[d] ) == 0 ) - { - /* check for exactly one rdn in case of ONE */ - if ( style == SLAP_LIMITS_ONE ) { - /* - * if ndn is more that one rdn - * below dn_pat, continue - */ - if ( (size_t) dn_rdnlen( NULL, ndn ) - != d - 1 ) - { - break; - } - } + /* check that ndn ends with lm_pat */ + if ( strcmp( lm[0]->lm_pat.bv_val, &ndn->bv_val[d] ) != 0 ) { + break; + } - *limit = &lm[0]->lm_limits; - return( 0 ); + /* in case of ONE, require exactly one rdn below lm_pat */ + if ( style == SLAP_LIMITS_ONE ) { + if ( dn_rdnlen( NULL, ndn ) != d - 1 ) { + break; + } } - break; + goto found_dn; } case SLAP_LIMITS_REGEX: - if ( ndn->bv_len == 0 ) { - break; - } - if ( regexec( &lm[0]->lm_regex, ndn->bv_val, - 0, NULL, 0 ) == 0 ) - { - *limit = &lm[0]->lm_limits; - return( 0 ); + if ( regexec( &lm[0]->lm_regex, ndn->bv_val, 0, NULL, 0 ) == 0 ) { + goto found_dn; } break; case SLAP_LIMITS_ANONYMOUS: - if ( ndn->bv_len == 0 ) { - *limit = &lm[0]->lm_limits; - return( 0 ); - } break; case SLAP_LIMITS_USERS: - if ( ndn->bv_len != 0 ) { - *limit = &lm[0]->lm_limits; - return( 0 ); - } - break; + found_nodn: + Debug( LDAP_DEBUG_TRACE, "<== limits_get: type=%s match=%s\n", + dn_source[isthis], limits2str( style ), 0 ); + found_any: + *limit = &lm[0]->lm_limits; + return( 0 ); - case SLAP_LIMITS_ANY: + found_dn: + Debug( LDAP_DEBUG_TRACE, + "<== limits_get: type=%s match=%s dn=\"%s\"\n", + dn_source[isthis], limits2str( style ), lm[0]->lm_pat.bv_val ); + *limit = &lm[0]->lm_limits; + return( 0 ); + + found_group: + Debug( LDAP_DEBUG_TRACE, "<== limits_get: type=GROUP match=EXACT " + "dn=\"%s\" oc=\"%s\" ad=\"%s\"\n", + lm[0]->lm_pat.bv_val, + lm[0]->lm_group_oc->soc_cname.bv_val, + lm[0]->lm_group_ad->ad_cname.bv_val ); *limit = &lm[0]->lm_limits; return( 0 ); @@ -178,8 +219,8 @@ limits_add( struct slap_limits *lm; unsigned type, style; - assert( be ); - assert( limit ); + assert( be != NULL ); + assert( limit != NULL ); type = flags & SLAP_LIMITS_TYPE_MASK; style = flags & SLAP_LIMITS_MASK; @@ -188,6 +229,7 @@ limits_add( case SLAP_LIMITS_ANONYMOUS: case SLAP_LIMITS_USERS: case SLAP_LIMITS_ANY: + /* For these styles, type == 0 (SLAP_LIMITS_TYPE_SELF). */ for ( i = 0; be->be_limits && be->be_limits[ i ]; i++ ) { if ( be->be_limits[ i ]->lm_flags == style ) { return( -1 ); @@ -207,12 +249,11 @@ limits_add( case SLAP_LIMITS_ONE: case SLAP_LIMITS_SUBTREE: case SLAP_LIMITS_CHILDREN: - lm->lm_flags = style | type; { int rc; struct berval bv; - bv.bv_val = (char *) pattern; - bv.bv_len = strlen( pattern ); + + ber_str2bv( pattern, 0, 0, &bv ); rc = dnNormalize( 0, NULL, NULL, &bv, &lm->lm_pat, NULL ); if ( rc != LDAP_SUCCESS ) { @@ -223,7 +264,6 @@ limits_add( break; case SLAP_LIMITS_REGEX: - lm->lm_flags = style | type; ber_str2bv( pattern, 0, 1, &lm->lm_pat ); if ( regcomp( &lm->lm_regex, lm->lm_pat.bv_val, REG_EXTENDED | REG_ICASE ) ) { @@ -236,21 +276,20 @@ limits_add( case SLAP_LIMITS_ANONYMOUS: case SLAP_LIMITS_USERS: case SLAP_LIMITS_ANY: - lm->lm_flags = style | type; - lm->lm_pat.bv_val = NULL; - lm->lm_pat.bv_len = 0; + BER_BVZERO( &lm->lm_pat ); break; } switch ( type ) { case SLAP_LIMITS_TYPE_GROUP: - assert( group_oc ); - assert( group_ad ); + assert( group_oc != NULL ); + assert( group_ad != NULL ); lm->lm_group_oc = group_oc; lm->lm_group_ad = group_ad; break; } + lm->lm_flags = style | type; lm->lm_limits = *limit; i = 0; @@ -266,6 +305,8 @@ limits_add( return( 0 ); } +#define STRSTART( s, m ) (strncasecmp( s, m, STRLENOF( "" m "" )) == 0) + int limits_parse( Backend *be, @@ -282,19 +323,13 @@ limits_parse( ObjectClass *group_oc = NULL; AttributeDescription *group_ad = NULL; - assert( be ); + assert( be != NULL ); if ( argc < 3 ) { -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, CRIT, - "%s : line %d: missing arg(s) in " - "\"limits \" line.\n", fname, lineno, 0 ); -#else Debug( LDAP_DEBUG_ANY, "%s : line %d: missing arg(s) in " "\"limits \" line.\n%s", fname, lineno, "" ); -#endif return( -1 ); } @@ -310,10 +345,12 @@ limits_parse( * * "anonymous" * "users" - * [ "dn" [ "." { "exact" | "base" | "onelevel" | "subtree" | children" - * | "regex" | "anonymous" } ] "=" ] + * [ "dn" [ "." { "this" | "self" } ] [ "." { "exact" | "base" | + * "onelevel" | "subtree" | "children" | "regex" | "anonymous" } ] + * "=" ] * * Note: + * "this" is the baseobject, "self" (the default) is the bound DN * "exact" and "base" are the same (exact match); * "onelevel" means exactly one rdn below, NOT including pattern * "subtree" means any rdn below, including pattern @@ -341,103 +378,94 @@ limits_parse( } else if ( strcasecmp( pattern, "users" ) == 0 ) { flags = SLAP_LIMITS_USERS; - } else if ( strncasecmp( pattern, "dn", sizeof( "dn" ) - 1 ) == 0 ) { - pattern += sizeof( "dn" ) - 1; + } else if ( STRSTART( pattern, "dn" ) ) { + pattern += STRLENOF( "dn" ); + flags = SLAP_LIMITS_TYPE_SELF; if ( pattern[0] == '.' ) { pattern++; - if ( strncasecmp( pattern, "exact", sizeof( "exact" ) - 1 ) == 0 ) { - flags = SLAP_LIMITS_EXACT; - pattern += sizeof( "exact" ) - 1; + if ( STRSTART( pattern, "this" ) ) { + flags = SLAP_LIMITS_TYPE_THIS; + pattern += STRLENOF( "this" ); + } else if ( STRSTART( pattern, "self" ) ) { + pattern += STRLENOF( "self" ); + } else { + goto got_dn_dot; + } + } + if ( pattern[0] == '.' ) { + pattern++; + got_dn_dot: + if ( STRSTART( pattern, "exact" ) ) { + flags |= SLAP_LIMITS_EXACT; + pattern += STRLENOF( "exact" ); - } else if ( strncasecmp( pattern, "base", sizeof( "base" ) - 1 ) == 0 ) { - flags = SLAP_LIMITS_BASE; - pattern += sizeof( "base" ) - 1; + } else if ( STRSTART( pattern, "base" ) ) { + flags |= SLAP_LIMITS_BASE; + pattern += STRLENOF( "base" ); - } else if ( strncasecmp( pattern, "one", sizeof( "one" ) - 1 ) == 0 ) { - flags = SLAP_LIMITS_ONE; - pattern += sizeof( "one" ) - 1; - if ( strncasecmp( pattern, "level", sizeof( "level" ) - 1 ) == 0 ) { - pattern += sizeof( "level" ) - 1; + } else if ( STRSTART( pattern, "one" ) ) { + flags |= SLAP_LIMITS_ONE; + pattern += STRLENOF( "one" ); + if ( STRSTART( pattern, "level" ) ) { + pattern += STRLENOF( "level" ); } else { -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, WARNING , - "%s : line %d: deprecated \"one\" style " - "\"limits \" line; " - "use \"onelevel\" instead.\n", fname, lineno, 0 ); -#else Debug( LDAP_DEBUG_ANY, "%s : line %d: deprecated \"one\" style " "\"limits \" line; " "use \"onelevel\" instead.\n", fname, lineno, 0 ); -#endif } - } else if ( strncasecmp( pattern, "sub", sizeof( "sub" ) - 1 ) == 0 ) { - flags = SLAP_LIMITS_SUBTREE; - pattern += sizeof( "sub" ) - 1; - if ( strncasecmp( pattern, "tree", sizeof( "tree" ) - 1 ) == 0 ) { - pattern += sizeof( "tree" ) - 1; + } else if ( STRSTART( pattern, "sub" ) ) { + flags |= SLAP_LIMITS_SUBTREE; + pattern += STRLENOF( "sub" ); + if ( STRSTART( pattern, "tree" ) ) { + pattern += STRLENOF( "tree" ); } else { -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, WARNING , - "%s : line %d: deprecated \"sub\" style " - "\"limits \" line; " - "use \"subtree\" instead.\n", fname, lineno, 0 ); -#else Debug( LDAP_DEBUG_ANY, "%s : line %d: deprecated \"sub\" style " "\"limits \" line; " "use \"subtree\" instead.\n", fname, lineno, 0 ); -#endif } - } else if ( strncasecmp( pattern, "children", sizeof( "children" ) - 1 ) == 0 ) { - flags = SLAP_LIMITS_CHILDREN; - pattern += sizeof( "children" ) - 1; + } else if ( STRSTART( pattern, "children" ) ) { + flags |= SLAP_LIMITS_CHILDREN; + pattern += STRLENOF( "children" ); - } else if ( strncasecmp( pattern, "regex", sizeof( "regex" ) - 1 ) == 0 ) { - flags = SLAP_LIMITS_REGEX; - pattern += sizeof( "regex" ) - 1; + } else if ( STRSTART( pattern, "regex" ) ) { + flags |= SLAP_LIMITS_REGEX; + pattern += STRLENOF( "regex" ); /* * this could be deprecated in favour * of the pattern = "anonymous" form */ - } else if ( strncasecmp( pattern, "anonymous", sizeof( "anonymous" ) - 1 ) == 0 ) { + } else if ( STRSTART( pattern, "anonymous" ) + && flags == SLAP_LIMITS_TYPE_SELF ) + { flags = SLAP_LIMITS_ANONYMOUS; pattern = NULL; + + } else { + /* force error below */ + if ( *pattern == '=' ) + --pattern; } } /* pre-check the data */ - switch ( flags ) { - case SLAP_LIMITS_ANONYMOUS: - case SLAP_LIMITS_USERS: - - /* no need for pattern */ - pattern = NULL; - break; - - default: + if ( pattern != NULL ) { if ( pattern[0] != '=' ) { -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, CRIT, - "%s : line %d: missing '=' in " - "\"dn[.{exact|base|onelevel|subtree" - "|children|regex|anonymous}]" "=\" in " - "\"limits \" line.\n", fname, lineno, 0 ); -#else Debug( LDAP_DEBUG_ANY, - "%s : line %d: missing '=' in " - "\"dn[.{exact|base|onelevel|subtree" - "|children|regex|anonymous}]" - "=\" in " - "\"limits \" " - "line.\n%s", - fname, lineno, "" ); -#endif + "%s : line %d: %s in " + "\"dn[.{this|self}][.{exact|base" + "|onelevel|subtree|children|regex" + "|anonymous}]=\" in " + "\"limits \" line.\n", + fname, lineno, + isalnum( (unsigned char)pattern[0] ) + ? "unknown DN modifier" : "missing '='" ); return( -1 ); } @@ -449,41 +477,40 @@ limits_parse( flags = SLAP_LIMITS_ANY; pattern = NULL; - } else if ( flags == SLAP_LIMITS_REGEX + } else if ( (flags & SLAP_LIMITS_MASK) == SLAP_LIMITS_REGEX && strcmp( pattern, ".*" ) == 0 ) { flags = SLAP_LIMITS_ANY; pattern = NULL; } } - } else if (strncasecmp( pattern, "group", sizeof( "group" ) - 1 ) == 0 ) { - pattern += sizeof( "group" ) - 1; + } else if (STRSTART( pattern, "group" ) ) { + pattern += STRLENOF( "group" ); if ( pattern[0] == '/' ) { struct berval oc, ad; oc.bv_val = pattern + 1; + pattern = strchr( pattern, '=' ); + if ( pattern == NULL ) { + return -1; + } - ad.bv_val = strchr(pattern, '/'); + ad.bv_val = strchr( oc.bv_val, '/' ); if ( ad.bv_val != NULL ) { const char *text = NULL; - int rc; oc.bv_len = ad.bv_val - oc.bv_val; ad.bv_val++; - ad.bv_len = strlen( ad.bv_val ); + ad.bv_len = pattern - ad.bv_val; rc = slap_bv2ad( &ad, &group_ad, &text ); if ( rc != LDAP_SUCCESS ) { goto no_ad; } - pattern = ad.bv_val + ad.bv_len; - } else { - oc.bv_len = strlen( oc.bv_val ); - - pattern = oc.bv_val + oc.bv_len; + oc.bv_len = pattern - oc.bv_val; } group_oc = oc_bvfind( &oc ); @@ -502,7 +529,6 @@ no_oc:; if ( group_ad == NULL ) { const char *text = NULL; - int rc; rc = slap_str2ad( SLAPD_GROUP_ATTR, &group_ad, &text ); @@ -515,21 +541,12 @@ no_ad:; flags = SLAP_LIMITS_TYPE_GROUP | SLAP_LIMITS_EXACT; if ( pattern[0] != '=' ) { -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, CRIT, - "%s : line %d: missing '=' in " - "\"group[/objectClass[/attributeType]]" - "=\" in " - "\"limits \" line.\n", - fname, lineno, 0 ); -#else Debug( LDAP_DEBUG_ANY, "%s : line %d: missing '=' in " "\"group[/objectClass[/attributeType]]" "=\" in " "\"limits \" line.\n", fname, lineno, 0 ); -#endif return( -1 ); } @@ -541,17 +558,10 @@ no_ad:; for ( i = 2; i < argc; i++ ) { if ( limits_parse_one( argv[i], &limit ) ) { -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, CRIT, - "%s : line %d: unknown limit values \"%s\" in " - "\"limits \" line.\n", - fname, lineno, argv[i] ); -#else Debug( LDAP_DEBUG_ANY, "%s : line %d: unknown limit values \"%s\" in " "\"limits \" line.\n", fname, lineno, argv[i] ); -#endif return( 1 ); } @@ -559,6 +569,8 @@ no_ad:; /* * sanity checks ... + * + * FIXME: add warnings? */ if ( limit.lms_t_hard > 0 && ( limit.lms_t_hard < limit.lms_t_soft @@ -571,21 +583,43 @@ no_ad:; || limit.lms_s_soft == -1 ) ) { limit.lms_s_hard = limit.lms_s_soft; } - + + /* + * defaults ... + * + * lms_t_hard: + * -1 => no limits + * 0 => same as soft + * > 0 => limit (in seconds) + * + * lms_s_hard: + * -1 => no limits + * 0 0> same as soft + * > 0 => limit (in entries) + * + * lms_s_pr_total: + * -2 => disable the control + * -1 => no limits + * 0 => same as soft + * > 0 => limit (in entries) + * + * lms_s_pr: + * -1 => no limits + * 0 => no limits? + * > 0 => limit size (in entries) + */ + if ( limit.lms_s_pr_total > 0 && + limit.lms_s_pr > limit.lms_s_pr_total ) { + limit.lms_s_pr = limit.lms_s_pr_total; + } + rc = limits_add( be, flags, pattern, group_oc, group_ad, &limit ); if ( rc ) { -#ifdef NEW_LOGGING - LDAP_LOG( CONFIG, CRIT, - "%s : line %d: unable to add limit in " - "\"limits \" line.\n", - fname, lineno, 0 ); -#else Debug( LDAP_DEBUG_ANY, "%s : line %d: unable to add limit in " "\"limits \" line.\n", fname, lineno, 0 ); -#endif } return( rc ); @@ -597,50 +631,61 @@ limits_parse_one( struct slap_limits_set *limit ) { - assert( arg ); - assert( limit ); + assert( arg != NULL ); + assert( limit != NULL ); - if ( strncasecmp( arg, "time", sizeof( "time" ) - 1 ) == 0 ) { - arg += 4; + if ( STRSTART( arg, "time" ) ) { + arg += STRLENOF( "time" ); if ( arg[0] == '.' ) { arg++; - if ( strncasecmp( arg, "soft", sizeof( "soft" ) - 1 ) == 0 ) { - arg += 4; - if ( arg[0] != '=' ) { - return( 1 ); - } - arg++; - if ( strcasecmp( arg, "none" ) == 0 ) { + if ( STRSTART( arg, "soft=" ) ) { + arg += STRLENOF( "soft=" ); + if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { limit->lms_t_soft = -1; + } else { - char *next = NULL; + int soft; - limit->lms_t_soft = - strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_t_soft < -1 ) { + if ( lutil_atoi( &soft, arg ) != 0 || soft < -1 ) { return( 1 ); } + + if ( soft == -1 ) { + /* FIXME: use "unlimited" instead; issue warning? */ + } + + limit->lms_t_soft = soft; } - } else if ( strncasecmp( arg, "hard", sizeof( "hard" ) - 1 ) == 0 ) { - arg += 4; - if ( arg[0] != '=' ) { - return( 1 ); - } - arg++; + } else if ( STRSTART( arg, "hard=" ) ) { + arg += STRLENOF( "hard=" ); if ( strcasecmp( arg, "soft" ) == 0 ) { limit->lms_t_hard = 0; - } else if ( strcasecmp( arg, "none" ) == 0 ) { + + } else if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { limit->lms_t_hard = -1; + } else { - char *next = NULL; + int hard; - limit->lms_t_hard = - strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_t_hard < -1 ) { + if ( lutil_atoi( &hard, arg ) != 0 || hard < -1 ) { return( 1 ); } + + if ( hard == -1 ) { + /* FIXME: use "unlimited" instead */ + } + + if ( hard == 0 ) { + /* FIXME: use "soft" instead */ + } + + limit->lms_t_hard = hard; } } else { @@ -649,13 +694,15 @@ limits_parse_one( } else if ( arg[0] == '=' ) { arg++; - if ( strcasecmp( arg, "none" ) == 0 ) { + if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { limit->lms_t_soft = -1; - } else { - char *next = NULL; - limit->lms_t_soft = strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_t_soft < -1 ) { + } else { + if ( lutil_atoi( &limit->lms_t_soft, arg ) != 0 + || limit->lms_t_soft < -1 ) + { return( 1 ); } } @@ -665,98 +712,155 @@ limits_parse_one( return( 1 ); } - } else if ( strncasecmp( arg, "size", sizeof( "size" ) - 1 ) == 0 ) { - arg += 4; + } else if ( STRSTART( arg, "size" ) ) { + arg += STRLENOF( "size" ); if ( arg[0] == '.' ) { arg++; - if ( strncasecmp( arg, "soft", sizeof( "soft" ) - 1 ) == 0 ) { - arg += 4; - if ( arg[0] != '=' ) { - return( 1 ); - } - arg++; - if ( strcasecmp( arg, "none" ) == 0 ) { + if ( STRSTART( arg, "soft=" ) ) { + arg += STRLENOF( "soft=" ); + if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { limit->lms_s_soft = -1; + } else { - char *next = NULL; + int soft; - limit->lms_s_soft = - strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_s_soft < -1 ) { + if ( lutil_atoi( &soft, arg ) != 0 || soft < -1 ) { return( 1 ); } + + if ( soft == -1 ) { + /* FIXME: use "unlimited" instead */ + } + + limit->lms_s_soft = soft; } - } else if ( strncasecmp( arg, "hard", sizeof( "hard" ) - 1 ) == 0 ) { - arg += 4; - if ( arg[0] != '=' ) { - return( 1 ); - } - arg++; + } else if ( STRSTART( arg, "hard=" ) ) { + arg += STRLENOF( "hard=" ); if ( strcasecmp( arg, "soft" ) == 0 ) { limit->lms_s_hard = 0; - } else if ( strcasecmp( arg, "none" ) == 0 ) { + + } else if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { limit->lms_s_hard = -1; + } else { - char *next = NULL; + int hard; - limit->lms_s_hard = - strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_s_hard < -1 ) { + if ( lutil_atoi( &hard, arg ) != 0 || hard < -1 ) { return( 1 ); } + + if ( hard == -1 ) { + /* FIXME: use "unlimited" instead */ + } + + if ( hard == 0 ) { + /* FIXME: use "soft" instead */ + } + + limit->lms_s_hard = hard; } - } else if ( strncasecmp( arg, "unchecked", sizeof( "unchecked" ) - 1 ) == 0 ) { - arg += 9; - if ( arg[0] != '=' ) { - return( 1 ); - } - arg++; - if ( strcasecmp( arg, "none" ) == 0 ) { + } else if ( STRSTART( arg, "unchecked=" ) ) { + arg += STRLENOF( "unchecked=" ); + if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { limit->lms_s_unchecked = -1; + + } else if ( strcasecmp( arg, "disabled" ) == 0 ) { + limit->lms_s_unchecked = 0; + } else { - char *next = NULL; + int unchecked; - limit->lms_s_unchecked = - strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_s_unchecked < -1 ) { + if ( lutil_atoi( &unchecked, arg ) != 0 || unchecked < -1 ) { return( 1 ); } - } - } else if ( strncasecmp( arg, "pr", sizeof( "pr" ) - 1 ) == 0 ) { - arg += sizeof( "pr" ) - 1; - if ( arg[0] != '=' ) { - return( 1 ); + if ( unchecked == -1 ) { + /* FIXME: use "unlimited" instead */ + } + + limit->lms_s_unchecked = unchecked; } - arg++; + + } else if ( STRSTART( arg, "pr=" ) ) { + arg += STRLENOF( "pr=" ); if ( strcasecmp( arg, "noEstimate" ) == 0 ) { limit->lms_s_pr_hide = 1; + + } else if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { + limit->lms_s_pr = -1; + } else { - char *next = NULL; + int pr; - limit->lms_s_pr = - strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_s_pr < -1 ) { + if ( lutil_atoi( &pr, arg ) != 0 || pr < -1 ) { return( 1 ); } + + if ( pr == -1 ) { + /* FIXME: use "unlimited" instead */ + } + + limit->lms_s_pr = pr; } - + + } else if ( STRSTART( arg, "prtotal=" ) ) { + arg += STRLENOF( "prtotal=" ); + + if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { + limit->lms_s_pr_total = -1; + + } else if ( strcasecmp( arg, "disabled" ) == 0 ) { + limit->lms_s_pr_total = -2; + + } else if ( strcasecmp( arg, "hard" ) == 0 ) { + limit->lms_s_pr_total = 0; + + } else { + int total; + + if ( lutil_atoi( &total, arg ) != 0 || total < -1 ) { + return( 1 ); + } + + if ( total == -1 ) { + /* FIXME: use "unlimited" instead */ + } + + if ( total == 0 ) { + /* FIXME: use "pr=disable" instead */ + } + + limit->lms_s_pr_total = total; + } + } else { return( 1 ); } } else if ( arg[0] == '=' ) { arg++; - if ( strcasecmp( arg, "none" ) == 0 ) { + if ( strcasecmp( arg, "unlimited" ) == 0 + || strcasecmp( arg, "none" ) == 0 ) + { limit->lms_s_soft = -1; - } else { - char *next = NULL; - limit->lms_s_soft = strtol( arg, &next, 10 ); - if ( next == arg || limit->lms_s_soft < -1 ) { + } else { + if ( lutil_atoi( &limit->lms_s_soft, arg ) != 0 + || limit->lms_s_soft < -1 ) + { return( 1 ); } } @@ -770,84 +874,482 @@ limits_parse_one( return 0; } +/* Helper macros for limits_unparse() and limits_unparse_one(): + * Write to ptr, but not past bufEnd. Move ptr past the new text. + * Return (success && enough room ? 0 : -1). + */ +#define ptr_APPEND_BV(bv) /* Append a \0-terminated berval */ \ + (WHATSLEFT <= (bv).bv_len ? -1 : \ + ((void) (ptr = lutil_strcopy( ptr, (bv).bv_val )), 0)) +#define ptr_APPEND_LIT(str) /* Append a string literal */ \ + (WHATSLEFT <= STRLENOF( "" str "" ) ? -1 : \ + ((void) (ptr = lutil_strcopy( ptr, str )), 0)) +#define ptr_APPEND_FMT(args) /* Append formatted text */ \ + (WHATSLEFT <= (tmpLen = snprintf args) ? -1 : ((void) (ptr += tmpLen), 0)) +#define ptr_APPEND_FMT1(fmt, arg) ptr_APPEND_FMT(( ptr, WHATSLEFT, fmt, arg )) +#define WHATSLEFT ((ber_len_t) (bufEnd - ptr)) + +/* Caller must provide an adequately sized buffer in bv */ +int +limits_unparse( struct slap_limits *lim, struct berval *bv, ber_len_t buflen ) +{ + struct berval btmp; + char *ptr, *bufEnd; /* Updated/used by ptr_APPEND_*()/WHATSLEFT */ + ber_len_t tmpLen; /* Used by ptr_APPEND_FMT*() */ + unsigned type, style; + int rc = 0; + + if ( !bv || !bv->bv_val ) return -1; + + ptr = bv->bv_val; + bufEnd = ptr + buflen; + type = lim->lm_flags & SLAP_LIMITS_TYPE_MASK; + + if ( type == SLAP_LIMITS_TYPE_GROUP ) { + rc = ptr_APPEND_FMT(( ptr, WHATSLEFT, "group/%s/%s=\"%s\"", + lim->lm_group_oc->soc_cname.bv_val, + lim->lm_group_ad->ad_cname.bv_val, + lim->lm_pat.bv_val )); + } else { + style = lim->lm_flags & SLAP_LIMITS_MASK; + switch( style ) { + case SLAP_LIMITS_ANONYMOUS: + case SLAP_LIMITS_USERS: + case SLAP_LIMITS_ANY: + rc = ptr_APPEND_BV( lmpats[style] ); + break; + case SLAP_LIMITS_UNDEFINED: + case SLAP_LIMITS_EXACT: + case SLAP_LIMITS_ONE: + case SLAP_LIMITS_SUBTREE: + case SLAP_LIMITS_CHILDREN: + case SLAP_LIMITS_REGEX: + rc = ptr_APPEND_FMT(( ptr, WHATSLEFT, "dn.%s%s=\"%s\"", + type == SLAP_LIMITS_TYPE_SELF ? "" : "this.", + lmpats[style].bv_val, lim->lm_pat.bv_val )); + break; + } + } + if ( rc == 0 ) { + bv->bv_len = ptr - bv->bv_val; + btmp.bv_val = ptr; + btmp.bv_len = 0; + rc = limits_unparse_one( &lim->lm_limits, + SLAP_LIMIT_SIZE | SLAP_LIMIT_TIME, + &btmp, WHATSLEFT ); + if ( rc == 0 ) + bv->bv_len += btmp.bv_len; + } + return rc; +} + +/* Caller must provide an adequately sized buffer in bv */ +int +limits_unparse_one( + struct slap_limits_set *lim, + int which, + struct berval *bv, + ber_len_t buflen ) +{ + char *ptr, *bufEnd; /* Updated/used by ptr_APPEND_*()/WHATSLEFT */ + ber_len_t tmpLen; /* Used by ptr_APPEND_FMT*() */ + + if ( !bv || !bv->bv_val ) return -1; + + ptr = bv->bv_val; + bufEnd = ptr + buflen; + + if ( which & SLAP_LIMIT_SIZE ) { + if ( lim->lms_s_soft != SLAPD_DEFAULT_SIZELIMIT ) { + + /* If same as global limit, drop it */ + if ( lim != &frontendDB->be_def_limit && + lim->lms_s_soft == frontendDB->be_def_limit.lms_s_soft ) + { + goto s_hard; + /* If there's also a hard limit, fully qualify this one */ + } else if ( lim->lms_s_hard ) { + if ( ptr_APPEND_LIT( " size.soft=" ) ) return -1; + + /* If doing both size & time, qualify this */ + } else if ( which & SLAP_LIMIT_TIME ) { + if ( ptr_APPEND_LIT( " size=" ) ) return -1; + } + + if ( lim->lms_s_soft == -1 + ? ptr_APPEND_LIT( "unlimited " ) + : ptr_APPEND_FMT1( "%d ", lim->lms_s_soft ) ) + return -1; + } +s_hard: + if ( lim->lms_s_hard ) { + if ( ptr_APPEND_LIT( " size.hard=" ) ) return -1; + if ( lim->lms_s_hard == -1 + ? ptr_APPEND_LIT( "unlimited " ) + : ptr_APPEND_FMT1( "%d ", lim->lms_s_hard ) ) + return -1; + } + if ( lim->lms_s_unchecked != -1 ) { + if ( ptr_APPEND_LIT( " size.unchecked=" ) ) return -1; + if ( lim->lms_s_unchecked == 0 + ? ptr_APPEND_LIT( "disabled " ) + : ptr_APPEND_FMT1( "%d ", lim->lms_s_unchecked ) ) + return -1; + } + if ( lim->lms_s_pr_hide ) { + if ( ptr_APPEND_LIT( " size.pr=noEstimate " ) ) return -1; + } + if ( lim->lms_s_pr ) { + if ( ptr_APPEND_LIT( " size.pr=" ) ) return -1; + if ( lim->lms_s_pr == -1 + ? ptr_APPEND_LIT( "unlimited " ) + : ptr_APPEND_FMT1( "%d ", lim->lms_s_pr ) ) + return -1; + } + if ( lim->lms_s_pr_total ) { + if ( ptr_APPEND_LIT( " size.prtotal=" ) ) return -1; + if ( lim->lms_s_pr_total == -1 ? ptr_APPEND_LIT( "unlimited " ) + : lim->lms_s_pr_total == -2 ? ptr_APPEND_LIT( "disabled " ) + : ptr_APPEND_FMT1( "%d ", lim->lms_s_pr_total ) ) + return -1; + } + } + + if ( which & SLAP_LIMIT_TIME ) { + if ( lim->lms_t_soft != SLAPD_DEFAULT_TIMELIMIT ) { + + /* If same as global limit, drop it */ + if ( lim != &frontendDB->be_def_limit && + lim->lms_t_soft == frontendDB->be_def_limit.lms_t_soft ) + { + goto t_hard; + + /* If there's also a hard limit, fully qualify this one */ + } else if ( lim->lms_t_hard ) { + if ( ptr_APPEND_LIT( " time.soft=" ) ) return -1; + + /* If doing both size & time, qualify this */ + } else if ( which & SLAP_LIMIT_SIZE ) { + if ( ptr_APPEND_LIT( " time=" ) ) return -1; + } + + if ( lim->lms_t_soft == -1 + ? ptr_APPEND_LIT( "unlimited " ) + : ptr_APPEND_FMT1( "%d ", lim->lms_t_soft ) ) + return -1; + } +t_hard: + if ( lim->lms_t_hard ) { + if ( ptr_APPEND_LIT( " time.hard=" ) ) return -1; + if ( lim->lms_t_hard == -1 + ? ptr_APPEND_LIT( "unlimited " ) + : ptr_APPEND_FMT1( "%d ", lim->lms_t_hard ) ) + return -1; + } + } + if ( ptr != bv->bv_val ) { + ptr--; + *ptr = '\0'; + bv->bv_len = ptr - bv->bv_val; + } + + return 0; +} int limits_check( Operation *op, SlapReply *rs ) { - assert( op ); - assert( rs ); + assert( op != NULL ); + assert( rs != NULL ); /* FIXME: should this be always true? */ assert( op->o_tag == LDAP_REQ_SEARCH); - + + /* protocol only allows 0..maxInt; + * + * internal searches: + * - may use SLAP_NO_LIMIT ( = -1 ) to indicate no limits; + * - should use slimit = N and tlimit = SLAP_NO_LIMIT to + * indicate searches that should return exactly N matches, + * and handle errors thru a callback (see for instance + * slap_sasl_match() and slap_sasl2dn()) + */ + if ( op->ors_tlimit == SLAP_NO_LIMIT && op->ors_slimit == SLAP_NO_LIMIT ) { + return 0; + } + /* allow root to set no limit */ if ( be_isroot( op ) ) { op->ors_limit = NULL; if ( op->ors_tlimit == 0 ) { - op->ors_tlimit = -1; + op->ors_tlimit = SLAP_NO_LIMIT; } if ( op->ors_slimit == 0 ) { - op->ors_slimit = -1; + op->ors_slimit = SLAP_NO_LIMIT; + } + + /* if paged results and slimit are requested */ + if ( get_pagedresults( op ) > SLAP_CONTROL_IGNORED && + op->ors_slimit != SLAP_NO_LIMIT ) { + PagedResultsState *ps = op->o_pagedresults_state; + int total = op->ors_slimit - ps->ps_count; + if ( total > 0 ) { + op->ors_slimit = total; + } else { + op->ors_slimit = 0; + } } /* if not root, get appropriate limits */ } else { - ( void ) limits_get( op, &op->o_ndn, &op->ors_limit ); + ( void ) limits_get( op, &op->ors_limit ); assert( op->ors_limit != NULL ); /* if no limit is required, use soft limit */ - if ( op->ors_tlimit <= 0 ) { + if ( op->ors_tlimit == 0 ) { op->ors_tlimit = op->ors_limit->lms_t_soft; - /* if requested limit higher than hard limit, abort */ - } else if ( op->ors_tlimit > op->ors_limit->lms_t_hard ) { - /* no hard limit means use soft instead */ - if ( op->ors_limit->lms_t_hard == 0 - && op->ors_limit->lms_t_soft > -1 - && op->ors_tlimit > op->ors_limit->lms_t_soft ) { - op->ors_tlimit = op->ors_limit->lms_t_soft; + /* limit required: check if legal */ + } else { + if ( op->ors_limit->lms_t_hard == 0 ) { + if ( op->ors_limit->lms_t_soft > 0 + && ( op->ors_tlimit > op->ors_limit->lms_t_soft ) ) { + op->ors_tlimit = op->ors_limit->lms_t_soft; + } - /* positive hard limit means abort */ } else if ( op->ors_limit->lms_t_hard > 0 ) { +#ifdef ABOVE_HARD_LIMIT_IS_ERROR + if ( op->ors_tlimit == SLAP_MAX_LIMIT ) { + op->ors_tlimit = op->ors_limit->lms_t_hard; + + } else if ( op->ors_tlimit > op->ors_limit->lms_t_hard ) { + /* error if exceeding hard limit */ + rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED; + send_ldap_result( op, rs ); + rs->sr_err = LDAP_SUCCESS; + return -1; + } +#else /* ! ABOVE_HARD_LIMIT_IS_ERROR */ + if ( op->ors_tlimit > op->ors_limit->lms_t_hard ) { + op->ors_tlimit = op->ors_limit->lms_t_hard; + } +#endif /* ! ABOVE_HARD_LIMIT_IS_ERROR */ + } + } + + /* else leave as is */ + + /* don't even get to backend if candidate check is disabled */ + if ( op->ors_limit->lms_s_unchecked == 0 ) { + rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED; + send_ldap_result( op, rs ); + rs->sr_err = LDAP_SUCCESS; + return -1; + } + + /* if paged results is requested */ + if ( get_pagedresults( op ) > SLAP_CONTROL_IGNORED ) { + int slimit = -2; + int pr_total; + PagedResultsState *ps = op->o_pagedresults_state; + + /* paged results is not allowed */ + if ( op->ors_limit->lms_s_pr_total == -2 ) { rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED; + rs->sr_text = "pagedResults control not allowed"; send_ldap_result( op, rs ); rs->sr_err = LDAP_SUCCESS; + rs->sr_text = NULL; return -1; } - - /* negative hard limit means no limit */ - } - - /* if no limit is required, use soft limit */ - if ( op->ors_slimit <= 0 ) { - if ( get_pagedresults( op ) && op->ors_limit->lms_s_pr != 0 ) { - op->ors_slimit = op->ors_limit->lms_s_pr; + + if ( op->ors_limit->lms_s_pr > 0 + && ps->ps_size > op->ors_limit->lms_s_pr ) + { + rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED; + rs->sr_text = "illegal pagedResults page size"; + send_ldap_result( op, rs ); + rs->sr_err = LDAP_SUCCESS; + rs->sr_text = NULL; + return -1; + } + + if ( op->ors_limit->lms_s_pr_total == 0 ) { + if ( op->ors_limit->lms_s_hard == 0 ) { + pr_total = op->ors_limit->lms_s_soft; + } else { + pr_total = op->ors_limit->lms_s_hard; + } } else { - op->ors_slimit = op->ors_limit->lms_s_soft; + pr_total = op->ors_limit->lms_s_pr_total; } - /* if requested limit higher than hard limit, abort */ - } else if ( op->ors_slimit > op->ors_limit->lms_s_hard ) { - /* no hard limit means use soft instead */ - if ( op->ors_limit->lms_s_hard == 0 - && op->ors_limit->lms_s_soft > -1 - && op->ors_slimit > op->ors_limit->lms_s_soft ) { - op->ors_slimit = op->ors_limit->lms_s_soft; + if ( pr_total == -1 ) { + if ( op->ors_slimit == 0 || op->ors_slimit == SLAP_MAX_LIMIT ) { + slimit = -1; - /* positive hard limit means abort */ - } else if ( op->ors_limit->lms_s_hard > 0 ) { + } else { + slimit = op->ors_slimit - ps->ps_count; + } + +#ifdef ABOVE_HARD_LIMIT_IS_ERROR + } else if ( pr_total > 0 && op->ors_slimit != SLAP_MAX_LIMIT + && ( op->ors_slimit == SLAP_NO_LIMIT + || op->ors_slimit > pr_total ) ) + { rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED; send_ldap_result( op, rs ); - rs->sr_err = LDAP_SUCCESS; + rs->sr_err = LDAP_SUCCESS; return -1; +#endif /* ! ABOVE_HARD_LIMIT_IS_ERROR */ + + } else { + /* if no limit is required, use soft limit */ + int total; + int slimit2; + + /* first round of pagedResults: + * set count to any appropriate limit */ + + /* if the limit is set, check that it does + * not violate any server-side limit */ +#ifdef ABOVE_HARD_LIMIT_IS_ERROR + if ( op->ors_slimit == SLAP_MAX_LIMIT ) +#else /* ! ABOVE_HARD_LIMIT_IS_ERROR */ + if ( op->ors_slimit == SLAP_MAX_LIMIT + || op->ors_slimit > pr_total ) +#endif /* ! ABOVE_HARD_LIMIT_IS_ERROR */ + { + slimit2 = op->ors_slimit = pr_total; + + } else if ( op->ors_slimit == 0 ) { + slimit2 = pr_total; + + } else { + slimit2 = op->ors_slimit; + } + + total = slimit2 - ps->ps_count; + + if ( total >= 0 ) { + if ( op->ors_limit->lms_s_pr > 0 ) { + /* use the smallest limit set by total/per page */ + if ( total < op->ors_limit->lms_s_pr ) { + slimit = total; + + } else { + /* use the perpage limit if any + * NOTE: + 1 because given value must be legal */ + slimit = op->ors_limit->lms_s_pr + 1; + } + + } else { + /* use the total limit if any */ + slimit = total; + } + + } else if ( op->ors_limit->lms_s_pr > 0 ) { + /* use the perpage limit if any + * NOTE: + 1 because the given value must be legal */ + slimit = op->ors_limit->lms_s_pr + 1; + + } else { + /* use the standard hard/soft limit if any */ + slimit = op->ors_limit->lms_s_hard; + } } - /* negative hard limit means no limit */ + /* if got any limit, use it */ + if ( slimit != -2 ) { + if ( op->ors_slimit == 0 ) { + op->ors_slimit = slimit; + + } else if ( slimit > 0 ) { + if ( op->ors_slimit - ps->ps_count > slimit ) { + rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED; + send_ldap_result( op, rs ); + rs->sr_err = LDAP_SUCCESS; + return -1; + } + op->ors_slimit = slimit; + + } else if ( slimit == 0 ) { + op->ors_slimit = 0; + } + + } else { + /* use the standard hard/soft limit if any */ + op->ors_slimit = pr_total; + } + + /* no limit requested: use soft, whatever it is */ + } else if ( op->ors_slimit == 0 ) { + op->ors_slimit = op->ors_limit->lms_s_soft; + + /* limit requested: check if legal */ + } else { + /* hard limit as soft (traditional behavior) */ + if ( op->ors_limit->lms_s_hard == 0 ) { + if ( op->ors_limit->lms_s_soft > 0 + && op->ors_slimit > op->ors_limit->lms_s_soft ) { + op->ors_slimit = op->ors_limit->lms_s_soft; + } + + /* explicit hard limit: error if violated */ + } else if ( op->ors_limit->lms_s_hard > 0 ) { +#ifdef ABOVE_HARD_LIMIT_IS_ERROR + if ( op->ors_slimit == SLAP_MAX_LIMIT ) { + op->ors_slimit = op->ors_limit->lms_s_hard; + + } else if ( op->ors_slimit > op->ors_limit->lms_s_hard ) { + /* if limit exceeds hard, error */ + rs->sr_err = LDAP_ADMINLIMIT_EXCEEDED; + send_ldap_result( op, rs ); + rs->sr_err = LDAP_SUCCESS; + return -1; + } +#else /* ! ABOVE_HARD_LIMIT_IS_ERROR */ + if ( op->ors_slimit > op->ors_limit->lms_s_hard ) { + op->ors_slimit = op->ors_limit->lms_s_hard; + } +#endif /* ! ABOVE_HARD_LIMIT_IS_ERROR */ + } } + + /* else leave as is */ } return 0; } +void +limits_free_one( + struct slap_limits *lm ) +{ + if ( ( lm->lm_flags & SLAP_LIMITS_MASK ) == SLAP_LIMITS_REGEX ) + regfree( &lm->lm_regex ); + + if ( !BER_BVISNULL( &lm->lm_pat ) ) + ch_free( lm->lm_pat.bv_val ); + + ch_free( lm ); +} + +void +limits_destroy( + struct slap_limits **lm ) +{ + int i; + + if ( lm == NULL ) { + return; + } + + for ( i = 0; lm[ i ]; i++ ) { + limits_free_one( lm[ i ] ); + } + + ch_free( lm ); +}