Add server side assert control support.

diff --git a/servers/slapd/back-bdb/add.c b/servers/slapd/back-bdb/add.c
index 0ccf2db32f974904b076ce3f5a9fa8b40c68bac7..37df7595a8ea144dbe5a663bb2013ed1f2a8805f 100644 (file)
--- a/servers/slapd/back-bdb/add.c
+++ b/servers/slapd/back-bdb/add.c
@@ -343,6 +343,14 @@ retry:     /* transaction retry */
 #endif
        }
 
+       if ( get_assert( op ) &&
+               ( test_filter( op, op->oq_add.rs_e, get_assertion( op ))
+                       != LDAP_COMPARE_TRUE ))
+       {
+               rs->sr_err = LDAP_ASSERTION_FAILED;
+               goto return_results;
+       }
+
        rs->sr_err = access_allowed( op, op->oq_add.rs_e,
                entry, NULL, ACL_WRITE, NULL );
 

diff --git a/servers/slapd/back-bdb/compare.c b/servers/slapd/back-bdb/compare.c
index 635208d9f54a1adce373ec3237a734db43cdb76f..d44c26ac6f15e24bcdaaa4c87ddd41ad1405ba2b 100644 (file)
--- a/servers/slapd/back-bdb/compare.c
+++ b/servers/slapd/back-bdb/compare.c
@@ -102,8 +102,15 @@ dn2entry_retry:
                goto done;
        }
 
-       rs->sr_err = access_allowed( op, e,
-               op->oq_compare.rs_ava->aa_desc, &op->oq_compare.rs_ava->aa_value, ACL_COMPARE, NULL );
+       if ( get_assert( op ) &&
+               ( test_filter( op, e, get_assertion( op )) != LDAP_COMPARE_TRUE ))
+       {
+               rs->sr_err = LDAP_ASSERTION_FAILED;
+               goto return_results;
+       }
+
+       rs->sr_err = access_allowed( op, e, op->oq_compare.rs_ava->aa_desc,
+               &op->oq_compare.rs_ava->aa_value, ACL_COMPARE, NULL );
        if ( ! rs->sr_err ) {
                rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
                goto return_results;

diff --git a/servers/slapd/back-bdb/delete.c b/servers/slapd/back-bdb/delete.c
index ef8dcd82d8ddcee381e3be2fe9d00b5c290ad6d3..4a03a0ab6b4c6e8c8b089b6227f5197d4b7e54e5 100644 (file)
--- a/servers/slapd/back-bdb/delete.c
+++ b/servers/slapd/back-bdb/delete.c
@@ -258,6 +258,13 @@ retry:     /* transaction retry */
                goto done;
        }
 
+       if ( get_assert( op ) &&
+               ( test_filter( op, e, get_assertion( op )) != LDAP_COMPARE_TRUE ))
+       {
+               rs->sr_err = LDAP_ASSERTION_FAILED;
+               goto return_results;
+       }
+
        rs->sr_err = access_allowed( op, e,
                entry, NULL, ACL_WRITE, NULL );
 

diff --git a/servers/slapd/back-bdb/init.c b/servers/slapd/back-bdb/init.c
index 41ecef07a0837aa0110501f33f7588275543d922..47e9ac03047e5809885cd1a3bce1309e1f74f954 100644 (file)
--- a/servers/slapd/back-bdb/init.c
+++ b/servers/slapd/back-bdb/init.c
@@ -571,18 +571,19 @@ bdb_initialize(
 )
 {
        static char *controls[] = {
+               LDAP_CONTROL_ASSERT,
+#ifdef LDAP_CLIENT_UPDATE
+               LDAP_CONTROL_CLIENT_UPDATE,
+#endif
                LDAP_CONTROL_MANAGEDSAIT,
                LDAP_CONTROL_NOOP,
 #ifdef LDAP_CONTROL_PAGEDRESULTS
                LDAP_CONTROL_PAGEDRESULTS,
 #endif
-               LDAP_CONTROL_VALUESRETURNFILTER,
 #ifdef LDAP_CONTROL_SUBENTRIES
                LDAP_CONTROL_SUBENTRIES,
 #endif
-#ifdef LDAP_CLIENT_UPDATE
-               LDAP_CONTROL_CLIENT_UPDATE,
-#endif
+               LDAP_CONTROL_VALUESRETURNFILTER,
                NULL
        };
 

diff --git a/servers/slapd/back-bdb/modify.c b/servers/slapd/back-bdb/modify.c
index 387f9f5551c172cbc38ebd9a5900189f763d4ddb..d5db616a1f18106ce161f131edc826d77001f3ad 100644 (file)
--- a/servers/slapd/back-bdb/modify.c
+++ b/servers/slapd/back-bdb/modify.c
@@ -453,6 +453,13 @@ retry:     /* transaction retry */
                goto done;
        }
 
+       if ( get_assert( op ) &&
+               ( test_filter( op, e, get_assertion( op )) != LDAP_COMPARE_TRUE ))
+       {
+               rs->sr_err = LDAP_ASSERTION_FAILED;
+               goto return_results;
+       }
+
 #if defined(LDAP_CLIENT_UPDATE) || defined(LDAP_SYNC)
        if ( rs->sr_err == LDAP_SUCCESS && !op->o_noop ) {
                LDAP_LIST_FOREACH ( ps_list, &bdb->bi_psearch_list, o_ps_link ) {
@@ -460,7 +467,7 @@ retry:      /* transaction retry */
                }
        }
 #endif
-       
+
        /* nested transaction */
        rs->sr_err = TXN_BEGIN( bdb->bi_dbenv, ltid, &lt2, 
                bdb->bi_db_opflags );

diff --git a/servers/slapd/back-bdb/modrdn.c b/servers/slapd/back-bdb/modrdn.c
index 412426f0b220c6d0a43607f32c8aeb8bf692b845..0a1c70f73a37a1554d2bdb44486b3e29edf6525c 100644 (file)
--- a/servers/slapd/back-bdb/modrdn.c
+++ b/servers/slapd/back-bdb/modrdn.c
@@ -182,9 +182,15 @@ retry:     /* transaction retry */
                goto done;
        }
 
+       if ( get_assert( op ) &&
+               ( test_filter( op, e, get_assertion( op )) != LDAP_COMPARE_TRUE ))
+       {
+               rs->sr_err = LDAP_ASSERTION_FAILED;
+               goto return_results;
+       }
+
        /* check write on old entry */
        rs->sr_err = access_allowed( op, e, entry, NULL, ACL_WRITE, NULL );
-
        if ( ! rs->sr_err ) {
                switch( opinfo.boi_err ) {
                case DB_LOCK_DEADLOCK:

diff --git a/servers/slapd/back-bdb/search.c b/servers/slapd/back-bdb/search.c
index 2c4c80e3ae0eedc6ff73680f08327d3d29cd8b59..b2f75748ded65632553ab04a32a6489d2624d7c1 100644 (file)
--- a/servers/slapd/back-bdb/search.c
+++ b/servers/slapd/back-bdb/search.c
@@ -615,6 +615,14 @@ dn2entry_retry:
                return 1;
        }
 
+       if ( get_assert( op ) &&
+               ( test_filter( op, e, get_assertion( op )) != LDAP_COMPARE_TRUE ))
+       {
+               rs->sr_err = LDAP_ASSERTION_FAILED;
+               send_ldap_result( sop, rs );
+               return 1;
+       }
+
        /* if not root, get appropriate limits */
        if ( be_isroot( op->o_bd, &sop->o_ndn ) ) {
                isroot = 1;