only abort update if failed pre/post read control is critical: the only thing RFC...

[openldap] / servers / slapd / backglue.c

diff --git a/servers/slapd/backglue.c b/servers/slapd/backglue.c
index 83cab67b52446097e66db54cf2e0449faeaf14c2..cce5905ee1b827595b6ea2bd2a8037e8765a0804 100644 (file)
--- a/servers/slapd/backglue.c
+++ b/servers/slapd/backglue.c
@@ -262,6 +262,13 @@ glue_chk_controls ( Operation *op, SlapReply *rs )
        return rc;
 }
 
+/* ITS#4615 - overlays configured above the glue overlay should be
+ * invoked for the entire glued tree. Overlays configured below the
+ * glue overlay should only be invoked on the master backend.
+ * So, if we're searching on any subordinates, we need to force the
+ * current overlay chain to stop processing, without stopping the
+ * overall callback flow.
+ */
 static int
 glue_sub_search( Operation *op, SlapReply *rs, BackendDB *b0,
        slap_overinst *on )
@@ -347,6 +354,8 @@ glue_op_search ( Operation *op, SlapReply *rs )
                                continue;
                        if (!dnIsSuffix(&btmp->be_nsuffix[0], &b1->be_nsuffix[0]))
                                continue;
+                       if (get_no_subordinate_glue(op) && btmp != b1)
+                               continue;
 
                        if (tlimit0 != SLAP_NO_LIMIT) {
                                op->o_time = slap_get_time();
@@ -378,6 +387,9 @@ glue_op_search ( Operation *op, SlapReply *rs )
                                if ( rs->sr_err == LDAP_NO_SUCH_OBJECT ) {
                                        gs.err = LDAP_SUCCESS;
                                }
+                               op->ors_scope = LDAP_SCOPE_ONELEVEL;
+                               op->o_req_dn = dn;
+                               op->o_req_ndn = ndn;
 
                        } else if (scope0 == LDAP_SCOPE_SUBTREE &&
                                dn_match(&op->o_bd->be_nsuffix[0], &ndn))
@@ -770,6 +782,13 @@ glue_db_init(
        BackendInfo     *bi = oi->oi_orig;
        glueinfo *gi;
 
+       if ( SLAP_GLUE_SUBORDINATE( be )) {
+               Debug( LDAP_DEBUG_ANY, "glue: backend %s is already subordinate, "
+                       "cannot have glue overlay!\n",
+                       be->be_suffix[0].bv_val, 0, 0 );
+               return LDAP_OTHER;
+       }
+
        gi = ch_calloc( 1, sizeof(glueinfo));
        on->on_bi.bi_private = gi;
        dnParent( be->be_nsuffix, &gi->gi_pdn );
@@ -955,6 +974,12 @@ glue_sub_add( BackendDB *be, int advert, int online )
        glue_Addrec *ga;
        int rc = 0;
 
+       if ( overlay_is_inst( be, "glue" )) {
+               Debug( LDAP_DEBUG_ANY, "glue: backend %s already has glue overlay, "
+                       "cannot be a subordinate!\n",
+                       be->be_suffix[0].bv_val, 0, 0 );
+               return LDAP_OTHER;
+       }
        SLAP_DBFLAGS( be ) |= SLAP_DBFLAG_GLUE_SUBORDINATE;
        if ( advert )
                SLAP_DBFLAGS( be ) |= SLAP_DBFLAG_GLUE_ADVERTISE;