Re: (ITS#3652) Add access_control() hook to overlays

[ando@sys-net.it]

Howard Chu wrote:

> ando@sys-net.it wrote:
>
>> One thing that scares me is that when running thru the stack of 
>> overlays,
>> if the SLAP_DBFLAG_OVERLAY flag is not set in the database structure, 
>> the
>> structure is copied in a temporary and the flag is set for the 
>> duration of
>> the operation; then the original copy is set again into the o_bd 
>> field of
>> the operation.
>>
>> I'm not sure if this is strictly required (why don't we just set that 
>> flag
>> into the original structure permanetly?) or if it poses a light or 
>> severe
>> performance penalty.
>>
> The flag indicates that the current structure is a temporary copy. 
> There may be a better way to do things. The reason it's copied is 
> because the op->o_bd->bd_info pointer must be set for each overlay 
> that gets invoked. And since the database structure is a shared 
> resource, we can't just write into the original, and we can't just 
> make one copy that's used everywhere (without adding a mutex, which is 
> not a good idea.)

I'm not saying it's a Bad Thing (TM) but I'm concerned about 
performances.  This should not be an issue with regular ops, where the 
copy occurs two or three times (at check referrals, for the operation 
call and for each result) but it would surely be for ACL.  I arranged 
things so that the BackendDB structure gets copied only if strictly 
required, to eliminate that overhead if, as typical, overlays don't 
define any access checking hook.

> Come to think of it, if we just added the pointer to the Operation 
> structure we could eliminate the copy. That would require updating all 
> the overlays to use the Operation pointer of course.

Would be neat (despite being yet another field that needs be copied when 
doing internal ops).

p.


    SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497