ACL cleanup

Likely needs more deadlock detection checks

diff --git a/servers/slapd/back-bdb/bind.c b/servers/slapd/back-bdb/bind.c
index 7a9230dcdc355291fae7a7323585a3396a5a6e49..f13338cdc0b77407822f9a0bf154e61fb170da1b 100644 (file)
--- a/servers/slapd/back-bdb/bind.c
+++ b/servers/slapd/back-bdb/bind.c
@@ -211,9 +211,9 @@ dn2entry_retry:
                        goto done;
                }
 
-               if ( ! access_allowed( be, conn, op, e,
-                       password, NULL, ACL_AUTH, NULL ) )
-               {
+               rc = access_allowed( be, conn, op, e,
+                       password, NULL, ACL_AUTH, NULL );
+               if ( ! rc ) {
                        send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
                                NULL, NULL, NULL, NULL );
                        goto done;
@@ -242,9 +242,9 @@ dn2entry_retry:
                        goto done;
                }
 
-               if ( ! access_allowed( be, conn, op, e,
-                       krbattr, NULL, ACL_AUTH, NULL ) )
-               {
+               rc = access_allowed( be, conn, op, e,
+                       krbattr, NULL, ACL_AUTH, NULL );
+               if ( ! rc ) {
                        send_ldap_result( conn, op, rc = LDAP_INSUFFICIENT_ACCESS,
                                NULL, NULL, NULL, NULL );
                        goto done;

diff --git a/servers/slapd/back-bdb/compare.c b/servers/slapd/back-bdb/compare.c
index c22c4311c71c269796052f3e6c959e9829559140..270077928a2dee9f6ad2e2fdf569a19662f1a451 100644 (file)
--- a/servers/slapd/back-bdb/compare.c
+++ b/servers/slapd/back-bdb/compare.c
@@ -110,9 +110,9 @@ dn2entry_retry:
                goto done;
        }
 
-       if ( ! access_allowed( be, conn, op, e,
-               ava->aa_desc, &ava->aa_value, ACL_COMPARE, NULL ) )
-       {
+       rc = access_allowed( be, conn, op, e,
+               ava->aa_desc, &ava->aa_value, ACL_COMPARE, NULL );
+       if ( ! rc ) {
                rc = LDAP_INSUFFICIENT_ACCESS;
                goto return_results;
        }
@@ -129,7 +129,6 @@ dn2entry_retry:
                        rc = LDAP_COMPARE_TRUE;
                        break;
                }
-
        }
 
 return_results:

diff --git a/servers/slapd/back-bdb/modrdn.c b/servers/slapd/back-bdb/modrdn.c
index bc7f6dc0cc61addb53502f2e2321738f7275bbbc..5878728a5841077b0551b69b337e6c37cedfbac8 100644 (file)
--- a/servers/slapd/back-bdb/modrdn.c
+++ b/servers/slapd/back-bdb/modrdn.c
@@ -272,9 +272,10 @@ retry:     /* transaction retry */
                }
 
                /* check parent for "children" acl */
-               if ( ! access_allowed( be, conn, op, p,
-                       children, NULL, ACL_WRITE, NULL ) )
-               {
+               rc = access_allowed( be, conn, op, p,
+                       children, NULL, ACL_WRITE, NULL ) );
+
+               if ( ! rc ) {
                        rc = LDAP_INSUFFICIENT_ACCESS;
 #ifdef NEW_LOGGING
                        LDAP_LOG ( OPERATION, ERR, 
@@ -326,8 +327,7 @@ retry:      /* transaction retry */
 
                                p = NULL;
 
-                               if ( ! rc )
-                               {
+                               if ( ! rc ) {
                                        rc = LDAP_INSUFFICIENT_ACCESS;
 #ifdef NEW_LOGGING
                                        LDAP_LOG ( OPERATION, ERR, 
@@ -408,6 +408,7 @@ retry:      /* transaction retry */
                        newSuperior = NULL; /* ignore newSuperior */
                }
        }
+
        if ( newSuperior != NULL ) {
                if ( newSuperior->bv_len ) {
                        np_dn = newSuperior;
@@ -462,7 +463,10 @@ retry:     /* transaction retry */
 #endif
 
                        /* check newSuperior for "children" acl */
-                       if ( !access_allowed( be, conn, op, np, children, NULL, ACL_WRITE, NULL ) ) {
+                       rc = access_allowed( be, conn, op, np, children,
+                               NULL, ACL_WRITE, NULL );
+
+                       if( ! rc ) {
 #ifdef NEW_LOGGING
                                LDAP_LOG ( OPERATION, DETAIL1, 
                                        "==>bdb_modrdn: no wr to newSup children\n", 0, 0, 0 );
@@ -525,8 +529,7 @@ retry:      /* transaction retry */
 
                                        np = NULL;
 
-                                       if ( ! rc )
-                                       {
+                                       if ( ! rc ) {
                                                rc = LDAP_INSUFFICIENT_ACCESS;
 #ifdef NEW_LOGGING
                                                LDAP_LOG ( OPERATION, ERR,