ldap/servers/plugins/acl/acl.c | 28 ++++++++++++++++++++++------ ldap/servers/plugins/acl/acl.h | 1 + 2 files changed, 23 insertions(+), 6 deletions(-)

New commits: commit 892bf12c1bb8b10afea3d6ff711059bf04e362cc Author: Noriko Hosoi nhosoi@totoro.usersys.redhat.com Date: Tue Jan 15 16:11:45 2013 -0800

Ticket #342 - better error message when cache overflows

Bug description: ACL cache overflow error message is not very clear and repeated too many times.

Fix description: 1) print a message like this: Your ACL cache of %d slots has overflowed. This can happen when you have many ACIs. This ACI evaluation requires %d slots to cache. You can increase your max value by setting the attribute nsslapd-aclpb-max-selected-acls in cn=ACL Plugin,cn=plugins,cn=config to a value higher. A server restart is required. 2) print the error message only once per ACI evaluation instead of hundreds of times

https://fedorahosted.org/389/ticket/342

Reviewed by Mark (Thanks!!)

diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c index a5884fb..79213b3 100644 --- a/ldap/servers/plugins/acl/acl.c +++ b/ldap/servers/plugins/acl/acl.c @@ -3108,17 +3108,33 @@ acl__TestRights(Acl_PBlock *aclpb,int access, char **right, char ** map_generic, } }

- if ( j < aclpb->aclpb_last_cache_result) { + if (j < aclpb->aclpb_last_cache_result) { /* already in cache */ - } else if ( j < aclpb_max_cache_results ) { - /* j == aclpb->aclpb_last_cache_result && - j < ACLPB_MAX_CACHE_RESULTS */ + aclpb->aclpb_cache_result[j].result &= + ~ACLPB_CACHE_ERROR_REPORTED; + } else if (j < aclpb_max_cache_results) { + /* j == aclpb->aclpb_last_cache_result && + j < ACLPB_MAX_CACHE_RESULTS */ aclpb->aclpb_last_cache_result++; aclpb->aclpb_cache_result[j].aci_index = index; aclpb->aclpb_cache_result[j].aci_ruleType = aci->aci_ruleType; + aclpb->aclpb_cache_result[j].result &= + ~ACLPB_CACHE_ERROR_REPORTED; } else { /* cache overflow */ - slapi_log_error (SLAPI_LOG_FATAL, "acl__TestRights", "cache overflown\n"); - if ( rights_rv == ACL_RES_ALLOW) { + if (!(aclpb->aclpb_cache_result[j].result & + ACLPB_CACHE_ERROR_REPORTED)) { + slapi_log_error (SLAPI_LOG_FATAL, "acl__TestRights", + "Your ACL cache of %d slots has overflowed. " + "This can happen when you have many ACIs. " + "This ACI evaluation requires %d slots to cache. " + "You can increase your max value by setting the attribute " + "%s in cn=ACL Plugin,cn=plugins,cn=config to a value higher. " + "A server restart is required.\n", + j, aclpb_max_cache_results, ATTR_ACLPB_MAX_SELECTED_ACLS); + aclpb->aclpb_cache_result[j].result |= + ACLPB_CACHE_ERROR_REPORTED; + } + if (rights_rv == ACL_RES_ALLOW) { result_reason->deciding_aci = aci; result_reason->reason = ACL_REASON_EVALUATED_ALLOW; TNF_PROBE_1_DEBUG(acl__TestRights_end,"ACL","", diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h index 28c38e7..5e840a9 100644 --- a/ldap/servers/plugins/acl/acl.h +++ b/ldap/servers/plugins/acl/acl.h @@ -361,6 +361,7 @@ typedef struct result_cache { #define ACLPB_CACHE_SEARCH_RES_DENY (short)0x0008 /* used for DENY handles only */ #define ACLPB_CACHE_SEARCH_RES_SKIP (short)0x0010 /* used for both types */ #define ACLPB_CACHE_READ_RES_SKIP (short)0x0020 /* used for both types */ +#define ACLPB_CACHE_ERROR_REPORTED (short)0x8000 /* error is reported */ }r_cache_t;