POSIX mode plus ACL right caching for directories

diff --git a/etc/afpd/acls.c b/etc/afpd/acls.c
index bc32881a06e8238c86a237b84989bfe778a32e65..c87ef9a0079cb95f44f1be366d9aad8340e1397e 100644 (file)
--- a/etc/afpd/acls.c
+++ b/etc/afpd/acls.c
@@ -1095,7 +1095,7 @@ EC_CLEANUP:
  * Note: this gets called frequently and is a good place for optimizations !
  *
  * @param vol              (r) volume
- * @param dir              (r) directory
+ * @param dir              (rw) directory
  * @param path             (r) path to filesystem object
  * @param uuid             (r) UUID of user
  * @param requested_rights (r) requested Darwin ACE
@@ -1103,7 +1103,7 @@ EC_CLEANUP:
  * @returns                    AFP result code
 */
 static int check_acl_access(const struct vol *vol,
-                            const struct dir *dir,
+                            struct dir *dir,
                             const char *path,
                             const uuidp_t uuid,
                             uint32_t requested_rights)
@@ -1133,50 +1133,55 @@ static int check_acl_access(const struct vol *vol,
         goto EC_CLEANUP;
     }
 
+    if ((strcmp(path, ".") == 0) && (dir->d_rights_cache != 0xffffffff)) {
+        /* its a dir and the cache value is valid */
+        allowed_rights = dir->d_rights_cache;
+        LOG(log_debug, logtype_afpd, "allowed rights from dircache: 0x%08x", allowed_rights);
+    } else {
 #ifdef HAVE_SOLARIS_ACLS
-    EC_ZERO_LOG(solaris_acl_rights(path, &st, &allowed_rights));
+        EC_ZERO_LOG(solaris_acl_rights(path, &st, &allowed_rights));
 #endif
 #ifdef HAVE_POSIX_ACLS
-    EC_ZERO_LOG(posix_acl_rights(path, &st, &allowed_rights));
+        EC_ZERO_LOG(posix_acl_rights(path, &st, &allowed_rights));
 #endif
+        /*
+         * The DARWIN_ACE_DELETE right might implicitly result from write acces to the parent
+         * directory. As it seems the 10.6 AFP client is puzzled when this right is not
+         * allowed where a delete would succeed because the parent dir gives write perms.
+         * So we check the parent dir for write access and set the right accordingly.
+         * Currentyl acl2ownermode calls us with dir = NULL, because it doesn't make sense
+         * there to do this extra check -- afaict.
+         */
+        if (vol && dir && (requested_rights & DARWIN_ACE_DELETE)) {
+            int i;
+            uint32_t parent_rights = 0;
+
+            if (dir->d_did == DIRDID_ROOT_PARENT) {
+                /* use volume path */
+                EC_NULL_LOG_ERR(parent = bfromcstr(vol->v_path), AFPERR_MISC);
+            } else {
+                /* build path for parent */
+                EC_NULL_LOG_ERR(parent = bstrcpy(dir->d_fullpath), AFPERR_MISC);
+                EC_ZERO_LOG_ERR(bconchar(parent, '/'), AFPERR_MISC);
+                EC_ZERO_LOG_ERR(bcatcstr(parent, path), AFPERR_MISC);
+                EC_NEG1_LOG_ERR(i = bstrrchr(parent, '/'), AFPERR_MISC);
+                EC_ZERO_LOG_ERR(binsertch(parent, i, 1, 0), AFPERR_MISC);
+            }
 
-    LOG(log_debug, logtype_afpd, "allowed rights: 0x%08x", allowed_rights);
-
-    /*
-     * The DARWIN_ACE_DELETE right might implicitly result from write acces to the parent
-     * directory. As it seems the 10.6 AFP client is puzzled when this right is not
-     * allowed where a delete would succeed because the parent dir gives write perms.
-     * So we check the parent dir for write access and set the right accordingly.
-     * Currentyl acl2ownermode calls us with dir = NULL, because it doesn't make sense
-     * there to do this extra check -- afaict.
-     */
-    if (vol && dir && (requested_rights & DARWIN_ACE_DELETE)) {
-        int i;
-        uint32_t parent_rights = 0;
-
-        if (dir->d_did == DIRDID_ROOT_PARENT) {
-            /* use volume path */
-            EC_NULL_LOG_ERR(parent = bfromcstr(vol->v_path), AFPERR_MISC);
-        } else {
-            /* build path for parent */
-            EC_NULL_LOG_ERR(parent = bstrcpy(dir->d_fullpath), AFPERR_MISC);
-            EC_ZERO_LOG_ERR(bconchar(parent, '/'), AFPERR_MISC);
-            EC_ZERO_LOG_ERR(bcatcstr(parent, path), AFPERR_MISC);
-            EC_NEG1_LOG_ERR(i = bstrrchr(parent, '/'), AFPERR_MISC);
-            EC_ZERO_LOG_ERR(binsertch(parent, i, 1, 0), AFPERR_MISC);
-        }
-
-        LOG(log_debug, logtype_afpd,"parent: %s", cfrombstr(parent));
-        EC_ZERO_LOG_ERR(lstat(cfrombstr(parent), &st), AFPERR_MISC);
+            LOG(log_debug, logtype_afpd,"parent: %s", cfrombstr(parent));
+            EC_ZERO_LOG_ERR(lstat(cfrombstr(parent), &st), AFPERR_MISC);
 
 #ifdef HAVE_SOLARIS_ACLS
-        EC_ZERO_LOG(solaris_acl_rights(cfrombstr(parent), &st, &parent_rights));
+            EC_ZERO_LOG(solaris_acl_rights(cfrombstr(parent), &st, &parent_rights));
 #endif
 #ifdef HAVE_POSIX_ACLS
-    EC_ZERO_LOG(posix_acl_rights(path, &st, &allowed_rights));
+            EC_ZERO_LOG(posix_acl_rights(path, &st, &allowed_rights));
 #endif
-        if (parent_rights & (DARWIN_ACE_WRITE_DATA | DARWIN_ACE_DELETE_CHILD))
-            allowed_rights |= DARWIN_ACE_DELETE; /* man, that was a lot of work! */
+            if (parent_rights & (DARWIN_ACE_WRITE_DATA | DARWIN_ACE_DELETE_CHILD))
+                allowed_rights |= DARWIN_ACE_DELETE; /* man, that was a lot of work! */
+        }
+        LOG(log_debug, logtype_afpd, "allowed rights: 0x%08x", allowed_rights);
+        dir->d_rights_cache = allowed_rights;
     }
 
     if ((requested_rights & allowed_rights) != requested_rights) {

diff --git a/etc/afpd/directory.c b/etc/afpd/directory.c
index 40c2cc427b3343f92b0db9abc855652bd6f42f31..1181a94ecb49b00adfdb83ae895568a4e1f7b046 100644 (file)
--- a/etc/afpd/directory.c
+++ b/etc/afpd/directory.c
@@ -831,6 +831,7 @@ struct dir *dir_new(const char *m_name,
     dir->dcache_ino = st->st_ino;
     if (!S_ISDIR(st->st_mode))
         dir->d_flags = DIRF_ISFILE;
+    dir->d_rights_cache = 0xffffffff;
     return dir;
 }
 

diff --git a/include/atalk/directory.h b/include/atalk/directory.h
index 8fb331559a667f3c2804ee524b898fe5caf874f5..801db32643b714a7af010fcee807ff1265b503f7 100644 (file)
--- a/include/atalk/directory.h
+++ b/include/atalk/directory.h
@@ -72,6 +72,8 @@ struct dir {
     uint32_t    d_offcnt;             /* offspring count */
     uint16_t    d_vid;                /* only needed in the dircache, because
                                          we put all directories in one cache. */
+    uint32_t    d_rights_cache;       /* cached rights combinded from mode and possible ACL */
+
     /* Stuff used in the dircache */
     time_t      dcache_ctime;         /* inode ctime, used and modified by dircache */
     ino_t       dcache_ino;           /* inode number, used to detect changes in the dircache */