]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/back-ldbm/modrdn.c
More "entry" level ACLs for entry add, delete, and rename.
[openldap] / servers / slapd / back-ldbm / modrdn.c
index 195fa4d434f575c5e86171d73b6224481e492146..f71cfc615005f81699a973a06b05a26931b60069 100644 (file)
@@ -47,13 +47,16 @@ ldbm_back_modrdn(
 )
 {
        AttributeDescription *children = slap_schema.si_ad_children;
+       AttributeDescription *entry = slap_schema.si_ad_entry;
        struct ldbminfo *li = (struct ldbminfo *) be->be_private;
        struct berval   p_dn, p_ndn;
        struct berval   new_dn = { 0, NULL}, new_ndn = { 0, NULL };
        Entry           *e, *p = NULL;
        Entry           *matched;
+       /* LDAP v2 supporting correct attribute handling. */
+       LDAPRDN         *new_rdn = NULL;
+       LDAPRDN         *old_rdn = NULL;
        int             isroot = -1;
-       int             rootlock = 0;
 #define CAN_ROLLBACK   -1
 #define MUST_DESTROY   1
        int             rc = CAN_ROLLBACK;
@@ -62,10 +65,6 @@ ldbm_back_modrdn(
        const char *text = NULL;
        char textbuf[SLAP_TEXT_BUFLEN];
        size_t textlen = sizeof textbuf;
-       /* Added to support LDAP v2 correctly (deleteoldrdn thing) */
-       LDAPRDN         *new_rdn;
-       LDAPRDN         *old_rdn;
-       int             a_cnt, d_cnt;
        /* Added to support newSuperior */ 
        Entry           *np = NULL;     /* newSuperior Entry */
        struct berval   *np_ndn = NULL; /* newSuperior ndn */
@@ -75,11 +74,10 @@ ldbm_back_modrdn(
        int             manageDSAit = get_manageDSAit( op );
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "backend", LDAP_LEVEL_ENTRY,
+       LDAP_LOG( BACK_LDBM, ENTRY, 
                "ldbm_back_modrdn: dn: %s newSuperior=%s\n", 
                dn->bv_len ? dn->bv_val : "NULL",
-               ( newSuperior && newSuperior->bv_len )
-                       ? newSuperior->bv_val : "NULL" ));
+               ( newSuperior && newSuperior->bv_len ) ? newSuperior->bv_val : "NULL",0 );
 #else
        Debug( LDAP_DEBUG_TRACE,
                "==>ldbm_back_modrdn: dn: %s newSuperior=%s\n", 
@@ -88,6 +86,9 @@ ldbm_back_modrdn(
                        ? newSuperior->bv_val : "NULL", 0 );
 #endif
 
+       /* grab giant lock for writing */
+       ldap_pvt_thread_rdwr_wlock(&li->li_giant_rwlock);
+
        /* get entry with writer lock */
        if ( (e = dn2entry_w( be, ndn, &matched )) == NULL ) {
                char* matched_dn = NULL;
@@ -104,6 +105,8 @@ ldbm_back_modrdn(
                                NULL, dn, LDAP_SCOPE_DEFAULT );
                }
 
+               ldap_pvt_thread_rdwr_wunlock(&li->li_giant_rwlock);
+
                send_ldap_result( conn, op, LDAP_REFERRAL,
                        matched_dn, NULL, refs, NULL );
 
@@ -113,6 +116,26 @@ ldbm_back_modrdn(
                return( -1 );
        }
 
+       /* check entry for "entry" acl */
+       if ( ! access_allowed( be, conn, op, e,
+               entry, NULL, ACL_WRITE, NULL ) )
+       {
+#ifdef NEW_LOGGING
+               LDAP_LOG( BACK_LDBM, ERR, 
+                       "ldbm_back_modrdn: no write access to entry of (%s)\n", 
+                       dn->bv_val, 0, 0 );
+#else
+               Debug( LDAP_DEBUG_TRACE,
+                       "<=- ldbm_back_modrdn: no write access to entry\n", 0,
+                       0, 0 );
+#endif
+
+               send_ldap_result( conn, op, LDAP_INSUFFICIENT_ACCESS,
+                       NULL, "no write access to entry", NULL, NULL );
+
+               goto return_results;
+       }
+
        if (!manageDSAit && is_entry_referral( e ) ) {
                /* parent is a referral, don't allow add */
                /* parent is an alias, don't allow add */
@@ -120,8 +143,8 @@ ldbm_back_modrdn(
                        conn, op, e );
 
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                       "ldbm_back_modrdn: entry %s is a referral\n", e->e_dn ));
+               LDAP_LOG( BACK_LDBM, INFO, 
+                       "ldbm_back_modrdn: entry %s is a referral\n", e->e_dn, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE, "entry %s is referral\n", e->e_dn,
                    0, 0 );
@@ -136,8 +159,8 @@ ldbm_back_modrdn(
 
        if ( has_children( be, e ) ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                       "ldbm_back_modrdn: entry %s has children\n", e->e_dn ));
+               LDAP_LOG( BACK_LDBM, INFO, 
+                       "ldbm_back_modrdn: entry %s has children\n", e->e_dn, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE, "entry %s has children\n", e->e_dn,
                    0, 0 );
@@ -161,8 +184,9 @@ ldbm_back_modrdn(
 
                if( (p = dn2entry_w( be, &p_ndn, NULL )) == NULL) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                               "ldbm_back_modrdn: parent of %s does not exist\n", e->e_ndn ));
+                       LDAP_LOG( BACK_LDBM, INFO, 
+                               "ldbm_back_modrdn: parent of %s does not exist\n", 
+                               e->e_ndn, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_TRACE, "parent does not exist\n",
                                0, 0, 0);
@@ -176,11 +200,12 @@ ldbm_back_modrdn(
 
                /* check parent for "children" acl */
                if ( ! access_allowed( be, conn, op, p,
-                       children, NULL, ACL_WRITE ) )
+                       children, NULL, ACL_WRITE, NULL ) )
                {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                  "ldbm_back_modrdn: no access to parent of (%s)\n", e->e_dn ));
+                       LDAP_LOG( BACK_LDBM, INFO, 
+                               "ldbm_back_modrdn: no access to parent of (%s)\n", 
+                               e->e_dn, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_TRACE, "no access to parent\n", 0,
                                0, 0 );
@@ -192,9 +217,9 @@ ldbm_back_modrdn(
                }
 
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                          "ldbm_back_modrdn: wr to children of entry %s OK\n",
-                          p_ndn.bv_val ));
+               LDAP_LOG( BACK_LDBM, DETAIL1, 
+                       "ldbm_back_modrdn: wr to children of entry %s OK\n", 
+                       p_ndn.bv_val, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE,
                       "ldbm_back_modrdn: wr to children of entry %s OK\n",
@@ -208,8 +233,8 @@ ldbm_back_modrdn(
                }
 
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                          "ldbm_back_modrdn: parent dn=%s\n", p_dn.bv_val ));
+               LDAP_LOG( BACK_LDBM, DETAIL1, 
+                          "ldbm_back_modrdn: parent dn=%s\n", p_dn.bv_val, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: parent dn=%s\n",
                       p_dn.bv_val, 0, 0 );
@@ -223,15 +248,14 @@ ldbm_back_modrdn(
                                p = (Entry *)&slap_entry_root;
                                
                                rc = access_allowed( be, conn, op, p,
-                                               children, NULL, ACL_WRITE );
+                                               children, NULL, ACL_WRITE, NULL );
                                p = NULL;
                                                                
                                /* check parent for "children" acl */
                                if ( ! rc ) {
 #ifdef NEW_LOGGING
-                                       LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
-                                               "ldbm_back_modrdn: no access "
-                                               "to parent \"\"\n" ));
+                                       LDAP_LOG( BACK_LDBM, ERR,
+                                               "ldbm_back_modrdn: no access to parent \"\"\n", 0,0,0 );
 #else
                                        Debug( LDAP_DEBUG_TRACE,
                                                "<=- ldbm_back_modrdn: no "
@@ -246,9 +270,9 @@ ldbm_back_modrdn(
 
                        } else {
 #ifdef NEW_LOGGING
-                               LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
-                                          "ldbm_back_modrdn: (%s) has no "
-                                          "parent & not a root.\n", dn ));
+                               LDAP_LOG( BACK_LDBM, ERR, 
+                                       "ldbm_back_modrdn: (%s) has no parent & not a root.\n", 
+                                       dn, 0, 0 );
 #else
                                Debug( LDAP_DEBUG_TRACE,
                                        "<=- ldbm_back_modrdn: no parent & "
@@ -262,12 +286,9 @@ ldbm_back_modrdn(
                        }
                }
 
-               ldap_pvt_thread_mutex_lock(&li->li_root_mutex);
-               rootlock = 1;
-               
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                          "ldbm_back_modrdn: (%s) no parent, locked root.\n", e->e_dn ));
+               LDAP_LOG( BACK_LDBM, INFO, 
+                  "ldbm_back_modrdn: (%s) no parent, locked root.\n", e->e_dn, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE,
                       "ldbm_back_modrdn: no parent, locked root\n",
@@ -279,9 +300,9 @@ ldbm_back_modrdn(
 
        if ( newSuperior != NULL ) {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
+               LDAP_LOG( BACK_LDBM, DETAIL1, 
                        "ldbm_back_modrdn: new parent \"%s\" requested\n",
-                       newSuperior->bv_val ));
+                       newSuperior->bv_val, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE, 
                        "ldbm_back_modrdn: new parent \"%s\" requested...\n",
@@ -293,10 +314,9 @@ ldbm_back_modrdn(
                /* newSuperior == oldParent? */
                if ( dn_match( &p_ndn, np_ndn ) ) {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_INFO, "ldbm_back_modrdn: "
+                       LDAP_LOG( BACK_LDBM, INFO, "ldbm_back_modrdn: "
                                "new parent\"%s\" seems to be the same as the "
-                               "old parent \"%s\"\n",
-                               newSuperior->bv_val, p_dn.bv_val ));
+                               "old parent \"%s\"\n", newSuperior->bv_val, p_dn.bv_val, 0 );
 #else
                        Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: "
                                "new parent\"%s\" seems to be the same as the "
@@ -315,8 +335,9 @@ ldbm_back_modrdn(
                if ( nnewSuperior->bv_len ) {
                        if( (np = dn2entry_w( be, np_ndn, NULL )) == NULL) {
 #ifdef NEW_LOGGING
-                               LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
-                                       "ldbm_back_modrdn: newSup(ndn=%s) not found.\n", np_ndn->bv_val ));
+                               LDAP_LOG( BACK_LDBM, ERR, 
+                                       "ldbm_back_modrdn: newSup(ndn=%s) not found.\n", 
+                                       np_ndn->bv_val, 0, 0 );
 #else
                                Debug( LDAP_DEBUG_TRACE,
                                    "ldbm_back_modrdn: newSup(ndn=%s) not here!\n",
@@ -329,9 +350,9 @@ ldbm_back_modrdn(
                        }
 
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
+                       LDAP_LOG( BACK_LDBM, DETAIL1,
                                "ldbm_back_modrdn: wr to new parent OK np=%p, id=%ld\n",
-                               np, np->e_id ));
+                               np, np->e_id, 0 );
 #else
                        Debug( LDAP_DEBUG_TRACE,
                                "ldbm_back_modrdn: wr to new parent OK np=%p, id=%ld\n",
@@ -340,11 +361,11 @@ ldbm_back_modrdn(
 
                        /* check newSuperior for "children" acl */
                        if ( !access_allowed( be, conn, op, np, children, NULL,
-                                             ACL_WRITE ) )
+                                             ACL_WRITE, NULL ) )
                        {
 #ifdef NEW_LOGGING
-                               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                          "ldbm_back_modrdn: no wr to newSup children.\n" ));
+                               LDAP_LOG( BACK_LDBM, INFO,
+                                  "ldbm_back_modrdn: no wr to newSup children.\n", 0, 0, 0 );
 #else
                                Debug( LDAP_DEBUG_TRACE,
                                       "ldbm_back_modrdn: no wr to newSup children\n",
@@ -359,8 +380,8 @@ ldbm_back_modrdn(
                        if ( is_entry_alias( np ) ) {
                                /* parent is an alias, don't allow add */
 #ifdef NEW_LOGGING
-                               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                          "ldbm_back_modrdn: entry (%s) is an alias.\n", np->e_dn ));
+                               LDAP_LOG( BACK_LDBM, INFO,
+                                  "ldbm_back_modrdn: entry (%s) is an alias.\n", np->e_dn,0,0);
 #else
                                Debug( LDAP_DEBUG_TRACE, "entry is alias\n", 0, 0, 0 );
 #endif
@@ -375,15 +396,15 @@ ldbm_back_modrdn(
                        if ( is_entry_referral( np ) ) {
                                /* parent is a referral, don't allow add */
 #ifdef NEW_LOGGING
-                               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
+                               LDAP_LOG( BACK_LDBM, INFO,
                                        "ldbm_back_modrdn: entry (%s) is a referral\n",
-                               np->e_dn ));
+                                       np->e_dn, 0, 0 );
 #else
                                Debug( LDAP_DEBUG_TRACE, "entry (%s) is referral\n",
                                        np->e_dn, 0, 0 );
 #endif
 
-                               send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
+                               send_ldap_result( conn, op, LDAP_OTHER,
                                    NULL, "newSuperior is a referral", NULL, NULL );
 
                                goto return_results;
@@ -401,15 +422,15 @@ ldbm_back_modrdn(
                                        np = (Entry *)&slap_entry_root;
                                
                                        rc = access_allowed( be, conn, op, np,
-                                                       children, NULL, ACL_WRITE );
+                                                       children, NULL, ACL_WRITE, NULL );
                                        np = NULL;
                                                                
                                        /* check parent for "children" acl */
                                        if ( ! rc ) {
 #ifdef NEW_LOGGING
-                                               LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
+                                               LDAP_LOG( BACK_LDBM, ERR,
                                                        "ldbm_back_modrdn: no access "
-                                                       "to new superior \"\"\n" ));
+                                                       "to new superior \"\"\n", 0, 0, 0 );
 #else
                                                Debug( LDAP_DEBUG_TRACE,
                                                        "<=- ldbm_back_modrdn: no "
@@ -424,9 +445,9 @@ ldbm_back_modrdn(
 
                                } else {
 #ifdef NEW_LOGGING
-                                       LDAP_LOG(( "backend", LDAP_LEVEL_ERR,
-                                                  "ldbm_back_modrdn: \"\" "
-                                                  "not allowed as new superior\n" ));
+                                       LDAP_LOG( BACK_LDBM, ERR,
+                                               "ldbm_back_modrdn: \"\" not allowed as new superior\n",
+                                               0, 0, 0 );
 #else
                                        Debug( LDAP_DEBUG_TRACE,
                                                "<=- ldbm_back_modrdn: \"\" "
@@ -443,8 +464,8 @@ ldbm_back_modrdn(
                }
 
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                       "ldbm_back_modrdn: wr to new parent's children OK.\n" ));
+               LDAP_LOG( BACK_LDBM, DETAIL1,
+                       "ldbm_back_modrdn: wr to new parent's children OK.\n", 0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE,
                    "ldbm_back_modrdn: wr to new parent's children OK\n",
@@ -459,260 +480,110 @@ ldbm_back_modrdn(
        dnNormalize2( NULL, &new_dn, &new_ndn );
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-               "ldbm_back_modrdn: new ndn=%s\n", new_ndn.bv_val ));
+       LDAP_LOG( BACK_LDBM, DETAIL1, "ldbm_back_modrdn: new ndn=%s\n", 
+               new_ndn.bv_val, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: new ndn=%s\n",
            new_ndn.bv_val, 0, 0 );
 #endif
 
        /* check for abandon */
-       ldap_pvt_thread_mutex_lock( &op->o_abandonmutex );
        if ( op->o_abandon ) {
-               ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
                goto return_results;
        }
 
-       ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
        if ( ( rc_id = dn2id ( be, &new_ndn, &id ) ) || id != NOID ) {
                /* if (rc_id) something bad happened to ldbm cache */
                send_ldap_result( conn, op, 
-                       rc_id ? LDAP_OPERATIONS_ERROR : LDAP_ALREADY_EXISTS,
+                       rc_id ? LDAP_OTHER : LDAP_ALREADY_EXISTS,
                        NULL, NULL, NULL, NULL );
                goto return_results;
        }
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-               "ldbm_back_modrdn: new ndn (%s) does not exist\n", new_ndn.bv_val ));
+       LDAP_LOG( BACK_LDBM, INFO, "ldbm_back_modrdn: new ndn (%s) does not exist\n",
+               new_ndn.bv_val, 0, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE,
            "ldbm_back_modrdn: new ndn=%s does not exist\n",
            new_ndn.bv_val, 0, 0 );
 #endif
 
-
-       /* Get attribute types and values of our new rdn, we will
+       /* Get attribute type and attribute value of our new rdn, we will
         * need to add that to our new entry
         */
-       if ( ldap_str2rdn( newrdn->bv_val, &new_rdn, (char **)&text,
+       if ( ldap_bv2rdn( newrdn, &new_rdn, (char **)&text,
                LDAP_DN_FORMAT_LDAP ) )
        {
 #ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                       "ldbm_back_modrdn: can't figure out type(s)/value(s) of newrdn\n" ));
+               LDAP_LOG ( OPERATION, ERR, 
+                       "ldbm_back_modrdn: can't figure out "
+                       "type(s)/values(s) of newrdn\n", 
+                       0, 0, 0 );
 #else
                Debug( LDAP_DEBUG_TRACE,
-                   "ldbm_back_modrdn: can't figure out type(s)/value(s) of newrdn\n",
-                   0, 0, 0 );
+                       "ldbm_back_modrdn: can't figure out "
+                       "type(s)/values(s) of newrdn\n", 
+                       0, 0, 0 );
 #endif
-
-               send_ldap_result( conn, op, LDAP_OPERATIONS_ERROR,
-                       NULL, "unable to parse type(s)/value(s) used in RDN", NULL, NULL );
+               rc = LDAP_INVALID_DN_SYNTAX;
+               text = "unknown type(s) used in RDN";
                goto return_results;            
        }
 
 #ifdef NEW_LOGGING
-       LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                  "ldbm_back_modrdn: new_rdn_type=\"%s\", new_rdn_val=\"%s\"\n",
-                  new_rdn[0][0]->la_attr.bv_val, new_rdn[0][0]->la_value.bv_val ));
+       LDAP_LOG ( OPERATION, RESULTS, 
+               "ldbm_back_modrdn: new_rdn_type=\"%s\", "
+               "new_rdn_val=\"%s\"\n",
+               new_rdn[ 0 ][ 0 ]->la_attr.bv_val, 
+               new_rdn[ 0 ][ 0 ]->la_value.bv_val, 0 );
 #else
        Debug( LDAP_DEBUG_TRACE,
-              "ldbm_back_modrdn: new_rdn_type=\"%s\", new_rdn_val=\"%s\"\n",
-              new_rdn[0][0]->la_attr.bv_val, new_rdn[0][0]->la_value.bv_val, 0 );
-#endif
-
-       /* Retrieve the old rdn from the entry's dn */
-       if ( ldap_str2rdn( dn->bv_val, &old_rdn, (char **)&text,
-               LDAP_DN_FORMAT_LDAP ) )
-       {
-#ifdef NEW_LOGGING
-               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                          "ldbm_back_modrdn: can't figure out the old_rdn type(s)/value(s).\n" ));
-#else
-               Debug( LDAP_DEBUG_TRACE,
-                      "ldbm_back_modrdn: can't figure out the old_rdn type(s)/value(s)\n",
-                      0, 0, 0 );
-#endif
-
-               send_ldap_result( conn, op, LDAP_OTHER,
-                       NULL, "unable to parse type(s)/value(s) used in RDN from old DN", NULL, NULL );
-               goto return_results;            
-       }
-
-#if 0
-       if ( newSuperior == NULL
-               && charray_strcasecmp( (const char **)old_rdn_types, (const char **)new_rdn_types ) != 0 )
-       {
-           /* Not a big deal but we may say something */
-#ifdef NEW_LOGGING
-           LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                      "ldbm_back_modrdn: old_rdn_type=%s new_rdn_type=%s\n",
-                      old_rdn_types[0], new_rdn_types[0] ));
-#else
-           Debug( LDAP_DEBUG_TRACE,
-                  "ldbm_back_modrdn: old_rdn_type=%s, new_rdn_type=%s!\n",
-                  old_rdn_types[0], new_rdn_types[0], 0 );
-#endif
-       }               
-#endif
-
-#ifdef NEW_LOGGING
-       LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                  "ldbm_back_modrdn:  DN_X500\n" ));
-#else
-       Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: DN_X500\n",
-              0, 0, 0 );
-#endif
-
-       mod = NULL;
-       for ( a_cnt = 0; new_rdn[0][a_cnt]; a_cnt++ ) {
-               int                     rc;
-               AttributeDescription    *desc = NULL;
-               Modifications           *mod_tmp;
-
-               rc = slap_bv2ad( &new_rdn[0][a_cnt]->la_attr, &desc, &text );
-
-               if ( rc != LDAP_SUCCESS ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                  "ldbm_back_modrdn: slap_bv2ad error: %s (%s)\n",
-                                  text, new_rdn[0][a_cnt]->la_attr.bv_val ));
-#else
-                       Debug( LDAP_DEBUG_TRACE,
-                               "ldbm_back_modrdn: %s: %s (new)\n",
-                               text, new_rdn[0][a_cnt]->la_attr.bv_val, 0 );
-#endif
-
-                       send_ldap_result( conn, op, rc,
-                               NULL, text, NULL, NULL );
-
-                       goto return_results;            
-               }
-
-               if ( ! access_allowed( be, conn, op, e, 
-                               desc, &new_rdn[0][a_cnt]->la_value, ACL_WRITE ) ) {
-#ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                  "ldbm_back_modrdn: access "
-                                  "not allowed to attr \"%s\"\n",
-                                  new_rdn[0][a_cnt]->la_attr.bv_val ));
-#else
-                       Debug( LDAP_DEBUG_TRACE,
-                               "ldbm_back_modrdn: access not allowed "
-                               "to attr \"%s\"\n%s%s",
-                               new_rdn[0][a_cnt]->la_attr.bv_val, "", "" );
+               "ldbm_back_modrdn: new_rdn_type=\"%s\", "
+               "new_rdn_val=\"%s\"\n",
+               new_rdn[ 0 ][ 0 ]->la_attr.bv_val,
+               new_rdn[ 0 ][ 0 ]->la_value.bv_val, 0 );
 #endif
-                       send_ldap_result( conn, op, 
-                               LDAP_INSUFFICIENT_ACCESS,
-                               NULL, NULL, NULL, NULL );
-
-                       goto return_results;
-               }
-
-               mod_tmp = (Modifications *)ch_malloc( sizeof( Modifications )
-                       + 2 * sizeof( struct berval ) );
-               mod_tmp->sml_desc = desc;
-               mod_tmp->sml_bvalues = (BerVarray)( mod_tmp + 1 );
-               mod_tmp->sml_bvalues[0] = new_rdn[0][a_cnt]->la_value;
-               mod_tmp->sml_bvalues[1].bv_val = NULL;
-               mod_tmp->sml_op = SLAP_MOD_SOFTADD;
-               mod_tmp->sml_next = mod;
-               mod = mod_tmp;
-       }
 
-       /* Remove old rdn value if required */
        if ( deleteoldrdn ) {
-               /* Get value of old rdn */
-               if ( old_rdn == NULL ) {
+               if ( ldap_bv2rdn( dn, &old_rdn, (char **)&text,
+                       LDAP_DN_FORMAT_LDAP ) )
+               {
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                  "ldbm_back_modrdn: can't figure out old RDN value(s) from old RDN\n" ));
+                       LDAP_LOG ( OPERATION, ERR, 
+                               "ldbm_back_modrdn: can't figure out "
+                               "type(s)/values(s) of old_rdn\n", 
+                               0, 0, 0 );
 #else
                        Debug( LDAP_DEBUG_TRACE,
-                              "ldbm_back_modrdn: can't figure out oldRDN value(s) from old RDN\n",
-                              0, 0, 0 );
+                               "ldbm_back_modrdn: can't figure out "
+                               "the old_rdn type(s)/value(s)\n", 
+                               0, 0, 0 );
 #endif
-
-                       send_ldap_result( conn, op, LDAP_OTHER,
-                               NULL, "could not parse value(s) from old RDN", NULL, NULL );
+                       rc = LDAP_OTHER;
+                       text = "cannot parse RDN from old DN";
                        goto return_results;            
                }
-
-               for ( d_cnt = 0; old_rdn[0][d_cnt]; d_cnt++ ) {    
-                       int                     rc;
-                       AttributeDescription    *desc = NULL;
-                       Modifications           *mod_tmp;
-
-                       rc = slap_bv2ad( &old_rdn[0][d_cnt]->la_attr, &desc, &text );
-
-                       if ( rc != LDAP_SUCCESS ) {
-#ifdef NEW_LOGGING
-                               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                          "ldbm_back_modrdn: %s: %s (old)\n",
-                                          text, old_rdn[0][d_cnt]->la_attr.bv_val ));
-#else
-                               Debug( LDAP_DEBUG_TRACE,
-                                       "ldbm_back_modrdn: %s: %s (old)\n",
-                                       text, old_rdn[0][d_cnt]->la_attr.bv_val, 0 );
-#endif
-
-                               send_ldap_result( conn, op, rc,
-                                       NULL, text, NULL, NULL );
-
-                               goto return_results;
-                       }
-
-                       if ( ! access_allowed( be, conn, op, e, 
-                                       desc, &old_rdn[0][d_cnt]->la_value, ACL_WRITE ) ) {
-#ifdef NEW_LOGGING
-                               LDAP_LOG(( "backend", LDAP_LEVEL_INFO,
-                                          "ldbm_back_modrdn: access "
-                                          "not allowed to attr \"%s\"\n",
-                                          old_rdn[0][d_cnt]->la_attr.bv_val ));
-#else
-                               Debug( LDAP_DEBUG_TRACE,
-                                       "ldbm_back_modrdn: access not allowed "
-                                       "to attr \"%s\"\n%s%s",
-                                       old_rdn[0][d_cnt]->la_attr.bv_val, "", "" );
-#endif
-                               send_ldap_result( conn, op, 
-                                       LDAP_INSUFFICIENT_ACCESS,
-                                       NULL, NULL, NULL, NULL );
-
-                               goto return_results;
-                       }
-
-                       /* Remove old value of rdn as an attribute. */
-                       mod_tmp = (Modifications *)ch_malloc( sizeof( Modifications )
-                               + 2 * sizeof( struct berval ) );
-                       mod_tmp->sml_desc = desc;
-                       mod_tmp->sml_bvalues = (BerVarray)(mod_tmp+1);
-                       mod_tmp->sml_bvalues[0] = old_rdn[0][d_cnt]->la_value;
-                       mod_tmp->sml_bvalues[1].bv_val = NULL;
-                       mod_tmp->sml_op = LDAP_MOD_DELETE;
-                       mod_tmp->sml_next = mod;
-                       mod = mod_tmp;
+       }
 
 #ifdef NEW_LOGGING
-                       LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL1,
-                                  "ldbm_back_modrdn: removing old_rdn_val=%s\n", old_rdn[0][d_cnt]->la_value.bv_val ));
+       LDAP_LOG( BACK_LDBM, DETAIL1, "ldbm_back_modrdn:  DN_X500\n", 0, 0, 0 );
 #else
-                       Debug( LDAP_DEBUG_TRACE,
-                              "ldbm_back_modrdn: removing old_rdn_val=%s\n",
-                              old_rdn[0][d_cnt]->la_value.bv_val, 0, 0 );
+       Debug( LDAP_DEBUG_TRACE, "ldbm_back_modrdn: DN_X500\n",
+              0, 0, 0 );
 #endif
-               }
+       
+       rc = slap_modrdn2mods( be, conn, op, e, old_rdn, new_rdn, 
+                       deleteoldrdn, &mod );
+       if ( rc != LDAP_SUCCESS ) {
+               goto return_results;
        }
 
-       
+
        /* check for abandon */
-       ldap_pvt_thread_mutex_lock( &op->o_abandonmutex );
        if ( op->o_abandon ) {
-               ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
                goto return_results;
        }
-       ldap_pvt_thread_mutex_unlock( &op->o_abandonmutex );
 
        /* delete old one */
        if ( dn2id_delete( be, &e->e_nname, e->e_id ) != 0 ) {
@@ -782,9 +653,12 @@ return_results:
        if( new_ndn.bv_val != NULL ) free( new_ndn.bv_val );
 
        /* LDAP v2 supporting correct attribute handling. */
-       if( new_rdn ) ldap_rdnfree( new_rdn );
-       if( old_rdn ) ldap_rdnfree( old_rdn );
-
+       if ( new_rdn != NULL ) {
+               ldap_rdnfree( new_rdn );
+       }
+       if ( old_rdn != NULL ) {
+               ldap_rdnfree( old_rdn );
+       }
        if ( mod != NULL ) {
                Modifications *tmp;
                for (; mod; mod = tmp ) {
@@ -804,11 +678,6 @@ return_results:
                cache_return_entry_w( &li->li_cache, p );
        }
 
-       if ( rootlock ) {
-               /* release root writer lock */
-               ldap_pvt_thread_mutex_unlock(&li->li_root_mutex);
-       }
-
        /* free entry and writer lock */
        cache_return_entry_w( &li->li_cache, e );
        if ( rc == MUST_DESTROY ) {
@@ -817,5 +686,6 @@ return_results:
                 * the entry must be freed */
                entry_free( e );
        }
+       ldap_pvt_thread_rdwr_wunlock(&li->li_giant_rwlock);
        return( rc );
 }