fix previous commit

[openldap] / servers / slapd / backend.c

diff --git a/servers/slapd/backend.c b/servers/slapd/backend.c
index e69513647c325f94ffc603c8cfd89c47e49d2b5b..4552a6ac1c6d4ff3a7397c5725e211e229e29153 100644 (file)
--- a/servers/slapd/backend.c
+++ b/servers/slapd/backend.c
@@ -37,8 +37,6 @@
 #include "lutil.h"
 #include "lber_pvt.h"
 
-#include "ldap_rq.h"
-
 #ifdef LDAP_SLAPI
 #include "slapi/slapi.h"
 
@@ -100,8 +98,7 @@ int backend_init(void)
                return -1;
        }
 
-       for( bi=slap_binfo; bi->bi_type != NULL; bi++,nBackendInfo++ )
-       {
+       for( bi=slap_binfo; bi->bi_type != NULL; bi++,nBackendInfo++ ) {
                assert( bi->bi_init );
 
                rc = bi->bi_init( bi );
@@ -122,6 +119,7 @@ int backend_init(void)
                        }
                        return rc;
                }
+
                LDAP_STAILQ_INSERT_TAIL(&backendInfo, bi, bi_next);
        }
 
@@ -296,10 +294,6 @@ int backend_startup(Backend *be)
                (void)backend_init_controls( bi );
        }
 
-       ldap_pvt_thread_mutex_init( &slapd_rq.rq_mutex );
-       LDAP_STAILQ_INIT( &slapd_rq.task_list );
-       LDAP_STAILQ_INIT( &slapd_rq.run_list );
-
        /* open each backend database */
        i = -1;
        LDAP_STAILQ_FOREACH(be, &backendDB, be_next) {
@@ -311,34 +305,11 @@ int backend_startup(Backend *be)
                                i, be->bd_info->bi_type, 0 );
                }
                /* append global access controls */
-               acl_append( &be->be_acl, frontendDB->be_acl );
+               acl_append( &be->be_acl, frontendDB->be_acl, -1 );
 
                rc = backend_startup_one( be );
 
                if ( rc ) return rc;
-
-
-               if ( be->be_syncinfo ) {
-                       syncinfo_t *si;
-
-                       if ( !( be->be_search && be->be_add &&
-                               be->be_modify && be->be_delete )) {
-                               Debug( LDAP_DEBUG_ANY,
-                                       "backend_startup: database(%d) does not support "
-                                       "operations required for syncrepl", i, 0, 0 );
-                               continue;
-                       }
-
-                       {
-                               si = be->be_syncinfo;
-                               si->si_be = be;
-                               init_syncrepl( si );
-                               ldap_pvt_thread_mutex_lock( &slapd_rq.rq_mutex );
-                               ldap_pvt_runqueue_insert( &slapd_rq,
-                                               si->si_interval, do_syncrepl, (void *) si );
-                               ldap_pvt_thread_mutex_unlock( &slapd_rq.rq_mutex );
-                       }
-               }
        }
 
        return rc;
@@ -849,18 +820,18 @@ backend_check_controls(
                                break;
 
                        case LDAP_COMPARE_FALSE:
-                               if ( !op->o_bd->be_ctrls[ cid ] )
-                               {
+                               if ( !op->o_bd->be_ctrls[cid] && (*ctrls)->ldctl_iscritical ) {
                                        /* Per RFC 2251 (and LDAPBIS discussions), if the control
                                         * is recognized and appropriate for the operation (which
                                         * we've already verified), then the server should make
                                         * use of the control when performing the operation.
                                         * 
                                         * Here we find that operation extended by the control
-                                        * is not unavailable in a particular context, hence the
-                                        * return of unwillingToPerform.
+                                        * is unavailable in a particular context, and the control
+                                        * is marked Critical, hence the return of
+                                        * unwillingToPerform.
                                         */
-                                       rs->sr_text = "control unavailable in context";
+                                       rs->sr_text = "critical control unavailable in context";
                                        rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
                                        goto done;
                                }
@@ -871,6 +842,11 @@ backend_check_controls(
 
                        default:
                                /* unreachable */
+                               Debug( LDAP_DEBUG_ANY,
+                                       "backend_check_controls: unable to check control: %s\n",
+                                       (*ctrls)->ldctl_oid, 0, 0 );
+                               assert( 0 );
+
                                rs->sr_text = "unable to check control";
                                rs->sr_err = LDAP_OTHER;
                                goto done;
@@ -878,6 +854,12 @@ backend_check_controls(
                }
        }
 
+       /* check should be generalized */
+       if( get_manageDIT(op) && !be_isroot(op)) {
+               rs->sr_text = "requires manager authorization";
+               rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+       }
+
 done:;
        return rs->sr_err;
 }
@@ -1309,7 +1291,7 @@ backend_group(
                                }
                                
                                if ( rc == 0 ) {
-                                       rc = 1;
+                                       rc = LDAP_COMPARE_FALSE;
                                        for ( i = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ ) {
                                                if ( ldap_url_parse( a->a_vals[i].bv_val, &ludp ) !=
                                                        LDAP_URL_SUCCESS )
@@ -1382,6 +1364,8 @@ loopit:
                                SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
                                SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
                                a->a_nvals, op_ndn, op->o_tmpmemctx );
+                               if ( rc == LDAP_NO_SUCH_ATTRIBUTE )
+                                       rc = LDAP_COMPARE_FALSE;
                        }
                } else {
                        rc = LDAP_NO_SUCH_ATTRIBUTE;
@@ -1522,9 +1506,10 @@ backend_attribute(
                if ( a ) {
                        BerVarray v;
 
-                       if ( op->o_conn && access > ACL_NONE && access_allowed( op,
-                               e, entry_at, NULL, access,
-                               &acl_state ) == 0 ) {
+                       if ( op->o_conn && access > ACL_NONE &&
+                               access_allowed( op, e, entry_at, NULL,
+                                               access, &acl_state ) == 0 )
+                       {
                                rc = LDAP_INSUFFICIENT_ACCESS;
                                goto freeit;
                        }
@@ -1534,11 +1519,10 @@ backend_attribute(
                        
                        v = op->o_tmpalloc( sizeof(struct berval) * ( i + 1 ),
                                op->o_tmpmemctx );
-                       for ( i = 0,j = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ )
+                       for ( i = 0, j = 0; !BER_BVISNULL( &a->a_vals[i] ); i++ )
                        {
                                if ( op->o_conn && access > ACL_NONE && 
-                                               access_allowed( op, e,
-                                                       entry_at,
+                                       access_allowed( op, e, entry_at,
                                                        &a->a_nvals[i],
                                                        access,
                                                        &acl_state ) == 0 )
@@ -1752,14 +1736,14 @@ int backend_operational(
         * add them to the attribute list
         */
        if ( SLAP_OPATTRS( rs->sr_attr_flags ) || ( rs->sr_attrs &&
-               ad_inlist( slap_schema.si_ad_entryDN, rs->sr_attrs )))
+               ad_inlist( slap_schema.si_ad_entryDN, rs->sr_attrs ) ) )
        {
                *ap = slap_operational_entryDN( rs->sr_entry );
                ap = &(*ap)->a_next;
        }
 
        if ( SLAP_OPATTRS( rs->sr_attr_flags ) || ( rs->sr_attrs &&
-               ad_inlist( slap_schema.si_ad_subschemaSubentry, rs->sr_attrs )))
+               ad_inlist( slap_schema.si_ad_subschemaSubentry, rs->sr_attrs ) ) )
        {
                *ap = slap_operational_subschemaSubentry( op->o_bd );
                ap = &(*ap)->a_next;
@@ -1767,10 +1751,10 @@ int backend_operational(
 
        /* Let the overlays have a chance at this */
        be_orig = op->o_bd;
-       if ( SLAP_ISOVERLAY( be_orig ))
+       if ( SLAP_ISOVERLAY( be_orig ) )
                op->o_bd = select_backend( be_orig->be_nsuffix, 0, 0 );
 
-       if (( SLAP_OPATTRS( rs->sr_attr_flags ) || rs->sr_attrs ) &&
+       if ( ( SLAP_OPATTRS( rs->sr_attr_flags ) || rs->sr_attrs ) &&
                op->o_bd && op->o_bd->be_operational != NULL )
        {
                rc = op->o_bd->be_operational( op, rs );