ldap/servers/plugins/acl/acl.c | 28 ++++++++++++++++++++++------
ldap/servers/plugins/acl/acl.h | 1 +
2 files changed, 23 insertions(+), 6 deletions(-)
New commits:
commit 892bf12c1bb8b10afea3d6ff711059bf04e362cc
Author: Noriko Hosoi <nhosoi(a)totoro.usersys.redhat.com>
Date: Tue Jan 15 16:11:45 2013 -0800
Ticket #342 - better error message when cache overflows
Bug description: ACL cache overflow error message is not very clear
and repeated too many times.
Fix description:
1) print a message like this:
Your ACL cache of %d slots has overflowed. This can happen
when you have many ACIs. This ACI evaluation requires %d
slots to cache. You can increase your max value by setting
the attribute nsslapd-aclpb-max-selected-acls in cn=ACL
Plugin,cn=plugins,cn=config to a value higher. A server
restart is required.
2) print the error message only once per ACI evaluation instead
of hundreds of times
https://fedorahosted.org/389/ticket/342
Reviewed by Mark (Thanks!!)
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index a5884fb..79213b3 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -3108,17 +3108,33 @@ acl__TestRights(Acl_PBlock *aclpb,int access, char **right, char
** map_generic,
}
}
- if ( j < aclpb->aclpb_last_cache_result) {
+ if (j < aclpb->aclpb_last_cache_result) {
/* already in cache */
- } else if ( j < aclpb_max_cache_results ) {
- /* j == aclpb->aclpb_last_cache_result &&
- j < ACLPB_MAX_CACHE_RESULTS */
+ aclpb->aclpb_cache_result[j].result &=
+ ~ACLPB_CACHE_ERROR_REPORTED;
+ } else if (j < aclpb_max_cache_results) {
+ /* j == aclpb->aclpb_last_cache_result &&
+ j < ACLPB_MAX_CACHE_RESULTS */
aclpb->aclpb_last_cache_result++;
aclpb->aclpb_cache_result[j].aci_index = index;
aclpb->aclpb_cache_result[j].aci_ruleType = aci->aci_ruleType;
+ aclpb->aclpb_cache_result[j].result &=
+ ~ACLPB_CACHE_ERROR_REPORTED;
} else { /* cache overflow */
- slapi_log_error (SLAPI_LOG_FATAL, "acl__TestRights", "cache
overflown\n");
- if ( rights_rv == ACL_RES_ALLOW) {
+ if (!(aclpb->aclpb_cache_result[j].result &
+ ACLPB_CACHE_ERROR_REPORTED)) {
+ slapi_log_error (SLAPI_LOG_FATAL, "acl__TestRights",
+ "Your ACL cache of %d slots has overflowed. "
+ "This can happen when you have many ACIs. "
+ "This ACI evaluation requires %d slots to cache. "
+ "You can increase your max value by setting the attribute "
+ "%s in cn=ACL Plugin,cn=plugins,cn=config to a value higher. "
+ "A server restart is required.\n",
+ j, aclpb_max_cache_results, ATTR_ACLPB_MAX_SELECTED_ACLS);
+ aclpb->aclpb_cache_result[j].result |=
+ ACLPB_CACHE_ERROR_REPORTED;
+ }
+ if (rights_rv == ACL_RES_ALLOW) {
result_reason->deciding_aci = aci;
result_reason->reason = ACL_REASON_EVALUATED_ALLOW;
TNF_PROBE_1_DEBUG(acl__TestRights_end,"ACL","",
diff --git a/ldap/servers/plugins/acl/acl.h b/ldap/servers/plugins/acl/acl.h
index 28c38e7..5e840a9 100644
--- a/ldap/servers/plugins/acl/acl.h
+++ b/ldap/servers/plugins/acl/acl.h
@@ -361,6 +361,7 @@ typedef struct result_cache {
#define ACLPB_CACHE_SEARCH_RES_DENY (short)0x0008 /* used for DENY handles only */
#define ACLPB_CACHE_SEARCH_RES_SKIP (short)0x0010 /* used for both types */
#define ACLPB_CACHE_READ_RES_SKIP (short)0x0020 /* used for both types */
+#define ACLPB_CACHE_ERROR_REPORTED (short)0x8000 /* error is reported */
}r_cache_t;