I'm not sure if the fix is correct:
- if (req_acl->cond)
- ret = acl_exec_cond(req_acl->cond, px, s, txn, ACL_DIR_REQ);
+ if (!req_acl->cond)
+ continue;
Doesn't it ignore rules with no condition attached? I think that the
proper solution would be the following.
continue;
/* check condition, but only if attached */
- if (!req_acl->cond)
- continue;
+ if (req_acl->cond) {
+ ret = acl_exec_cond(req_acl->cond, px, s, txn, ACL_DIR_REQ);
+ ret = acl_pass(ret);
- ret = acl_exec_cond(req_acl->cond, px, s, txn, ACL_DIR_REQ);
- ret = acl_pass(ret);
- if (req_acl->cond->pol == ACL_COND_UNLESS)
- ret = !ret;
+ if (req_acl->cond->pol == ACL_COND_UNLESS)
+ ret = !ret;
+ }
if (ret) {
req_acl_final = req_acl;