New access_allowed()

diff --git a/servers/slapd/back-sql/add.c b/servers/slapd/back-sql/add.c
index 7f4155ea58e693ce442b24ed6509002076a1441f..6d9eca0c8849302057d820894d710446ef226526 100644 (file)
--- a/servers/slapd/back-sql/add.c
+++ b/servers/slapd/back-sql/add.c
@@ -929,11 +929,12 @@ backsql_add( Operation *op, SlapReply *rs )
        struct berval           pdn;
        struct berval           realdn = BER_BVNULL;
        int                     colnum;
-       slap_mask_t             mask;
 
        char                    textbuf[ SLAP_TEXT_BUFLEN ];
        size_t                  textlen = sizeof( textbuf );
 
+       AclCheck        ak;
+
 #ifdef BACKSQL_SYNCPROV
        /*
         * NOTE: fake successful result to force contextCSN to be bumped up
@@ -1069,9 +1070,12 @@ backsql_add( Operation *op, SlapReply *rs )
        }
 
        /* check write access */
-       if ( !access_allowed_mask( op, op->ora_e,
-                               slap_schema.si_ad_entry,
-                               NULL, ACL_WADD, NULL, &mask ) )
+       ak.ak_e = op->ora_e;
+       ak.ak_desc = slap_schema.si_ad_entry;
+       ak.ak_val = NULL;
+       ak.ak_access = ACL_WADD;
+       ak.ak_state = NULL;
+       if ( !access_allowed( op, &ak ))
        {
                rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
                e = op->ora_e;
@@ -1145,8 +1149,9 @@ backsql_add( Operation *op, SlapReply *rs )
                }
 
                /* check "children" pseudo-attribute access to parent */
-               if ( !access_allowed( op, &p, slap_schema.si_ad_children,
-                                       NULL, ACL_WADD, NULL ) )
+               ak.ak_e = &p;
+               ak.ak_desc = slap_schema.si_ad_children;
+               if ( !access_allowed( op, &ak ))
                {
                        rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
                        e = &p;
@@ -1495,15 +1500,19 @@ done:;
        if ( e != NULL ) {
                int     disclose = 1;
 
-               if ( e == op->ora_e && !ACL_GRANT( mask, ACL_DISCLOSE ) ) {
+               if ( e == op->ora_e && !ACL_GRANT( ak.ak_mask, ACL_DISCLOSE ) ) {
                        /* mask already collected */
                        disclose = 0;
 
-               } else if ( e == &p && !access_allowed( op, &p,
-                                       slap_schema.si_ad_entry, NULL,
-                                       ACL_DISCLOSE, NULL ) )
+               } else if ( e == &p ) 
                {
-                       disclose = 0;
+                       ak.ak_e = &p;
+                       ak.ak_desc = slap_schema.si_ad_entry;
+                       ak.ak_access = ACL_DISCLOSE;
+                       if ( !access_allowed( op, &ak ))
+                       {
+                               disclose = 0;
+                       }
                }
 
                if ( disclose == 0 ) {

diff --git a/servers/slapd/back-sql/compare.c b/servers/slapd/back-sql/compare.c
index 7cd0128afe1d143e4605ab49f5304885ac526d1c..97f4b65714b7b59aef25a7344147d636e73359fa 100644 (file)
--- a/servers/slapd/back-sql/compare.c
+++ b/servers/slapd/back-sql/compare.c
@@ -38,6 +38,7 @@ backsql_compare( Operation *op, SlapReply *rs )
        int                     rc;
        int                     manageDSAit = get_manageDSAit( op );
        AttributeName           anlist[2];
+       AclCheck        ak;
 
        Debug( LDAP_DEBUG_TRACE, "==>backsql_compare()\n", 0, 0, 0 );
 
@@ -117,9 +118,12 @@ backsql_compare( Operation *op, SlapReply *rs )
                *ap = nrs.sr_operational_attrs;
        }
 
-       if ( ! access_allowed( op, &e, op->oq_compare.rs_ava->aa_desc,
-                               &op->oq_compare.rs_ava->aa_value,
-                               ACL_COMPARE, NULL ) )
+       ak.ak_e = &e;
+       ak.ak_desc = op->oq_compare.rs_ava->aa_desc;
+       ak.ak_val = &op->oq_compare.rs_ava->aa_value;
+       ak.ak_access = ACL_COMPARE;
+       ak.ak_state = NULL;
+       if ( ! access_allowed( op, &ak ))
        {
                rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
                goto return_results;
@@ -149,10 +153,11 @@ return_results:;
                break;
 
        default:
+               ak.ak_desc = slap_schema.si_ad_entry;
+               ak.ak_val = NULL;
+               ak.ak_access = ACL_DISCLOSE;
                if ( !BER_BVISNULL( &e.e_nname ) &&
-                               ! access_allowed( op, &e,
-                                       slap_schema.si_ad_entry, NULL,
-                                       ACL_DISCLOSE, NULL ) )
+                               ! access_allowed( op, &ak ))
                {
                        rs->sr_err = LDAP_NO_SUCH_OBJECT;
                        rs->sr_text = NULL;

diff --git a/servers/slapd/back-sql/delete.c b/servers/slapd/back-sql/delete.c
index 0a171a9f577f627153cec72c682bb30d553da822..391b198ab71ad4290fdd297522fb8e2a019fc788 100644 (file)
--- a/servers/slapd/back-sql/delete.c
+++ b/servers/slapd/back-sql/delete.c
@@ -295,13 +295,15 @@ backsql_tree_delete_search_cb( Operation *op, SlapReply *rs )
        if ( rs->sr_type == REP_SEARCH ) {
                backsql_tree_delete_t   *btd;
                backsql_entryID         *eid;
+               AclCheck ak = { rs->sr_entry, slap_schema.si_ad_entry, NULL,
+                       ACL_WDEL, NULL };
+               int ret;
 
                btd = (backsql_tree_delete_t *)op->o_callback->sc_private;
 
-               if ( !access_allowed( btd->btd_op, rs->sr_entry,
-                       slap_schema.si_ad_entry, NULL, ACL_WDEL, NULL )
-                       || !access_allowed( btd->btd_op, rs->sr_entry,
-                       slap_schema.si_ad_children, NULL, ACL_WDEL, NULL ) )
+               ret = access_allowed( btd->btd_op, &ak );
+               ak.ak_desc = slap_schema.si_ad_children;
+               if ( !ret || !access_allowed( btd->btd_op, &ak ))
                {
                        btd->btd_rc = LDAP_INSUFFICIENT_ACCESS;
                        return rs->sr_err = LDAP_UNAVAILABLE;
@@ -410,6 +412,7 @@ backsql_delete( Operation *op, SlapReply *rs )
        Entry                   d = { 0 }, p = { 0 }, *e = NULL;
        struct berval           pdn = BER_BVNULL;
        int                     manageDSAit = get_manageDSAit( op );
+       AclCheck        ak;
 
        Debug( LDAP_DEBUG_TRACE, "==>backsql_delete(): deleting entry \"%s\"\n",
                        op->o_req_ndn.bv_val, 0, 0 );
@@ -476,8 +479,12 @@ backsql_delete( Operation *op, SlapReply *rs )
                goto done;
        }
 
-       if ( !access_allowed( op, &d, slap_schema.si_ad_entry, 
-                       NULL, ACL_WDEL, NULL ) )
+       ak.ak_e = &d;
+       ak.ak_desc = slap_schema.si_ad_entry;
+       ak.ak_val = NULL;
+       ak.ak_access = ACL_WDEL;
+       ak.ak_state = NULL;
+       if ( !access_allowed( op, &ak ))
        {
                Debug( LDAP_DEBUG_TRACE, "   backsql_delete(): "
                        "no write access to entry\n", 
@@ -550,8 +557,9 @@ backsql_delete( Operation *op, SlapReply *rs )
                (void)backsql_free_entryID( &bsi.bsi_base_id, 0, op->o_tmpmemctx );
 
                /* check parent for "children" acl */
-               if ( !access_allowed( op, &p, slap_schema.si_ad_children, 
-                               NULL, ACL_WDEL, NULL ) )
+               ak.ak_e = &p;
+               ak.ak_desc = slap_schema.si_ad_children;
+               if ( !access_allowed( op, &ak ))
                {
                        Debug( LDAP_DEBUG_TRACE, "   backsql_delete(): "
                                "no write access to parent\n", 
@@ -594,8 +602,10 @@ backsql_delete( Operation *op, SlapReply *rs )
 
 done:;
        if ( e != NULL ) {
-               if ( !access_allowed( op, e, slap_schema.si_ad_entry, NULL,
-                                       ACL_DISCLOSE, NULL ) )
+               ak.ak_e = e;
+               ak.ak_desc = slap_schema.si_ad_entry;
+               ak.ak_access = ACL_DISCLOSE;
+               if ( !access_allowed( op, &ak ))
                {
                        rs->sr_err = LDAP_NO_SUCH_OBJECT;
                        rs->sr_text = NULL;

diff --git a/servers/slapd/back-sql/modify.c b/servers/slapd/back-sql/modify.c
index 941bc3754831ae5e79f04209473fd6e475a4bf3c..8ee5c1c912304378903d36df66e5b746ea0c3a94 100644 (file)
--- a/servers/slapd/back-sql/modify.c
+++ b/servers/slapd/back-sql/modify.c
@@ -176,8 +176,8 @@ do_transact:;
 
 done:;
        if ( e != NULL ) {
-               if ( !access_allowed( op, e, slap_schema.si_ad_entry, NULL,
-                                       ACL_DISCLOSE, NULL ) )
+               AclCheck ak = { e, slap_schema.si_ad_entry, NULL, ACL_DISCLOSE, NULL };
+               if ( !access_allowed( op, &ak ))
                {
                        rs->sr_err = LDAP_NO_SUCH_OBJECT;
                        rs->sr_text = NULL;

diff --git a/servers/slapd/back-sql/modrdn.c b/servers/slapd/back-sql/modrdn.c
index fafd98ee545029d981ad7737330f340a070d0a8a..a509a31e989558d77641ee29a448a72ad8e38fdf 100644 (file)
--- a/servers/slapd/back-sql/modrdn.c
+++ b/servers/slapd/back-sql/modrdn.c
@@ -50,6 +50,7 @@ backsql_modrdn( Operation *op, SlapReply *rs )
                                *e = NULL;
        int                     manageDSAit = get_manageDSAit( op );
        struct berval           *newSuperior = op->oq_modrdn.rs_newSup;
+       AclCheck        ak;
  
        Debug( LDAP_DEBUG_TRACE, "==>backsql_modrdn() renaming entry \"%s\", "
                        "newrdn=\"%s\", newSuperior=\"%s\"\n",
@@ -137,8 +138,12 @@ backsql_modrdn( Operation *op, SlapReply *rs )
        /*
         * Check for entry access to target
         */
-       if ( !access_allowed( op, &r, slap_schema.si_ad_entry, 
-                               NULL, ACL_WRITE, NULL ) ) {
+       ak.ak_e = &r;
+       ak.ak_desc = slap_schema.si_ad_entry;
+       ak.ak_val = NULL;
+       ak.ak_access = ACL_WRITE;
+       ak.ak_state = NULL;
+       if ( !access_allowed( op, &ak )) {
                Debug( LDAP_DEBUG_TRACE, "   no access to entry\n", 0, 0, 0 );
                rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
                goto done;
@@ -189,8 +194,10 @@ backsql_modrdn( Operation *op, SlapReply *rs )
                goto done;
        }
 
-       if ( !access_allowed( op, &p, slap_schema.si_ad_children, NULL,
-                       newSuperior ? ACL_WDEL : ACL_WRITE, NULL ) )
+       ak.ak_e = &p;
+       ak.ak_desc = slap_schema.si_ad_children;
+       if ( newSuperior ) ak.ak_desc = ACL_WDEL;
+       if ( !access_allowed( op, &ak ))
        {
                Debug( LDAP_DEBUG_TRACE, "   no access to parent\n", 0, 0, 0 );
                rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
@@ -244,8 +251,9 @@ backsql_modrdn( Operation *op, SlapReply *rs )
                        n_id.eid_id, 0, 0 );
 #endif /* ! BACKSQL_ARBITRARY_KEY */
 
-               if ( !access_allowed( op, &n, slap_schema.si_ad_children, 
-                                       NULL, ACL_WADD, NULL ) ) {
+               ak.ak_e = &n;
+               ak.ak_access = ACL_WADD;
+               if ( !access_allowed( op, &ak )) {
                        Debug( LDAP_DEBUG_TRACE, "   backsql_modrdn(): "
                                        "no access to new parent \"%s\"\n", 
                                        new_pdn->bv_val, 0, 0 );
@@ -468,8 +476,10 @@ backsql_modrdn( Operation *op, SlapReply *rs )
 
 done:;
        if ( e != NULL ) {
-               if ( !access_allowed( op, e, slap_schema.si_ad_entry, NULL,
-                                       ACL_DISCLOSE, NULL ) )
+               ak.ak_e = e;
+               ak.ak_desc = slap_schema.si_ad_entry;
+               ak.ak_access = ACL_DISCLOSE;
+               if ( !access_allowed( op, &ak ))
                {
                        rs->sr_err = LDAP_NO_SUCH_OBJECT;
                        rs->sr_text = NULL;

diff --git a/servers/slapd/back-sql/search.c b/servers/slapd/back-sql/search.c
index 7b7f78487d7969df59c0a1bf9167c477ff055b95..b6a5401e6a0ff1ecead345decde9f969d6417678 100644 (file)
--- a/servers/slapd/back-sql/search.c
+++ b/servers/slapd/back-sql/search.c
@@ -2017,6 +2017,7 @@ backsql_search( Operation *op, SlapReply *rs )
 #ifndef BACKSQL_ARBITRARY_KEY
        ID                      lastid = 0;
 #endif /* ! BACKSQL_ARBITRARY_KEY */
+       AclCheck        ak = { &base_entry, slap_schema.si_ad_entry, NULL };
 
        Debug( LDAP_DEBUG_TRACE, "==>backsql_search(): "
                "base=\"%s\", filter=\"%s\", scope=%d,", 
@@ -2088,10 +2089,9 @@ backsql_search( Operation *op, SlapReply *rs )
                /* fall thru */
 
        default:
+               ak.ak_access = ACL_DISCLOSE;
                if ( !BER_BVISNULL( &base_entry.e_nname )
-                               && !access_allowed( op, &base_entry,
-                                       slap_schema.si_ad_entry, NULL,
-                                       ACL_DISCLOSE, NULL ) )
+                               && !access_allowed( op, &ak ))
                {
                        rs->sr_err = LDAP_NO_SUCH_OBJECT;
                        if ( rs->sr_ref ) {
@@ -2118,8 +2118,6 @@ backsql_search( Operation *op, SlapReply *rs )
        /* NOTE: __NEW__ "search" access is required
         * on searchBase object */
        {
-               slap_mask_t     mask;
-               
                if ( get_assert( op ) &&
                                ( test_filter( op, &base_entry, get_assertion( op ) )
                                  != LDAP_COMPARE_TRUE ) )
@@ -2127,9 +2125,8 @@ backsql_search( Operation *op, SlapReply *rs )
                        rs->sr_err = LDAP_ASSERTION_FAILED;
                        
                }
-               if ( ! access_allowed_mask( op, &base_entry,
-                                       slap_schema.si_ad_entry,
-                                       NULL, ACL_SEARCH, NULL, &mask ) )
+               ak.ak_access = ACL_SEARCH;
+               if ( ! access_allowed( op, &ak ))
                {
                        if ( rs->sr_err == LDAP_SUCCESS ) {
                                rs->sr_err = LDAP_INSUFFICIENT_ACCESS;
@@ -2137,7 +2134,7 @@ backsql_search( Operation *op, SlapReply *rs )
                }
 
                if ( rs->sr_err != LDAP_SUCCESS ) {
-                       if ( !ACL_GRANT( mask, ACL_DISCLOSE ) ) {
+                       if ( !ACL_GRANT( ak.ak_mask, ACL_DISCLOSE ) ) {
                                rs->sr_err = LDAP_NO_SUCH_OBJECT;
                                rs->sr_text = NULL;
                        }