]> git.sur5r.net Git - openldap/blobdiff - servers/slapd/bconfig.c
Fix rev 1.52, frontendDB uses index {-1}.
[openldap] / servers / slapd / bconfig.c
index c500b9971f2248ed316158c951da0b4e1c391d82..1db3ec0045e40d2ac7dccdb28baad1539526322c 100644 (file)
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 2005 The OpenLDAP Foundation.
+ * Copyright 2005-2006 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -159,6 +159,7 @@ enum {
        CFG_SSTR_IF_MAX,
        CFG_SSTR_IF_MIN,
        CFG_TTHREADS,
+       CFG_MIRRORMODE,
 
        CFG_LAST
 };
@@ -211,6 +212,12 @@ static OidRec OidMacros[] = {
  * OLcfgOv{Oc|At}:6                    -> smbk5pwd
  * OLcfgOv{Oc|At}:7                    -> distproc
  * OLcfgOv{Oc|At}:8                    -> dynlist
+ * OLcfgOv{Oc|At}:9                    -> dds
+ * OLcfgOv{Oc|At}:10           -> unique
+ * OLcfgOv{Oc|At}:11           -> refint
+ * OLcfgOv{Oc|At}:12           -> ppolicy
+ * OLcfgOv{Oc|At}:13           -> constraint
+ * OLcfgOv{Oc|At}:14           -> translucent
  */
 
 /* alphabetical ordering */
@@ -246,7 +253,7 @@ static ConfigTable config_back_cf_table[] = {
                &config_generic, "( OLcfgGlAt:5 NAME 'olcAttributeOptions' "
                        "EQUALITY caseIgnoreMatch "
                        "SYNTAX OMsDirectoryString )", NULL, NULL },
-       { "attribute",  "attribute", 2, 0, 9,
+       { "attribute",  "attribute", 2, 0, STRLENOF( "attribute" ),
                ARG_PAREN|ARG_MAGIC|CFG_ATTR|ARG_NO_DELETE|ARG_NO_INSERT,
                &config_generic, "( OLcfgGlAt:4 NAME 'olcAttributeTypes' "
                        "DESC 'OpenLDAP attributeTypes' "
@@ -346,6 +353,9 @@ static ConfigTable config_back_cf_table[] = {
        { "maxDerefDepth", "depth", 2, 2, 0, ARG_DB|ARG_INT|ARG_MAGIC|CFG_DEPTH,
                &config_generic, "( OLcfgDbAt:0.6 NAME 'olcMaxDerefDepth' "
                        "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
+       { "mirrormode", "on|off", 2, 2, 0, ARG_DB|ARG_ON_OFF|ARG_MAGIC|CFG_MIRRORMODE,
+               &config_generic, "( OLcfgDbAt:0.16 NAME 'olcMirrorMode' "
+                       "SYNTAX OMsBoolean SINGLE-VALUE )", NULL, NULL },
        { "moduleload", "file", 2, 0, 0,
 #ifdef SLAPD_MODULES
                ARG_MAGIC|CFG_MODLOAD, &config_generic,
@@ -505,8 +515,13 @@ static ConfigTable config_back_cf_table[] = {
        { "syncrepl", NULL, 0, 0, 0, ARG_DB|ARG_MAGIC,
                &syncrepl_config, "( OLcfgDbAt:0.11 NAME 'olcSyncrepl' "
                        "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL },
-       { "threads", "count", 2, 2, 0, ARG_INT|ARG_MAGIC|CFG_THREADS,
-               &config_generic, "( OLcfgGlAt:66 NAME 'olcThreads' "
+       { "threads", "count", 2, 2, 0,
+#ifdef NO_THREADS
+               ARG_IGNORED, NULL,
+#else
+               ARG_INT|ARG_MAGIC|CFG_THREADS, &config_generic,
+#endif
+               "( OLcfgGlAt:66 NAME 'olcThreads' "
                        "SYNTAX OMsInteger SINGLE-VALUE )", NULL, NULL },
        { "timelimit", "limit", 2, 0, 0, ARG_MAY_DB|ARG_MAGIC,
                &config_timelimit, "( OLcfgGlAt:67 NAME 'olcTimeLimit' "
@@ -668,7 +683,7 @@ static ConfigOCs cf_ocs[] = {
                 "olcReplicaArgsFile $ olcReplicaPidFile $ olcReplicationInterval $ "
                 "olcReplogFile $ olcRequires $ olcRestrict $ olcRootDN $ olcRootPW $ "
                 "olcSchemaDN $ olcSecurity $ olcSizeLimit $ olcSyncrepl $ "
-                "olcTimeLimit $ olcUpdateDN $ olcUpdateRef ) )",
+                "olcTimeLimit $ olcUpdateDN $ olcUpdateRef $ olcMirrorMode ) )",
                        Cft_Database, NULL, cfAddDatabase },
        { "( OLcfgGlOc:5 "
                "NAME 'olcOverlayConfig' "
@@ -741,7 +756,8 @@ config_generic(ConfigArgs *c) {
                                                break;
                                        }
                                        bv.bv_val = buf + bv.bv_len;
-                                       limits_unparse( c->be->be_limits[i], &bv );
+                                       limits_unparse( c->be->be_limits[i], &bv,
+                                                       sizeof( buf ) - ( bv.bv_val - buf ) );
                                        bv.bv_len += bv.bv_val - buf;
                                        bv.bv_val = buf;
                                        value_add_one( &c->rvalue_vals, &bv );
@@ -786,6 +802,9 @@ config_generic(ConfigArgs *c) {
                                rc = 1;
                        }
                        break;
+               case CFG_ATOPT:
+                       ad_unparse_options( &c->rvalue_vals );
+                       break;
                case CFG_OC: {
                        ConfigFile *cf = c->private;
                        if ( !cf )
@@ -837,7 +856,7 @@ config_generic(ConfigArgs *c) {
                                AC_MEMCPY( abv.bv_val, ibuf, abv.bv_len );
                                /* Turn TAB / EOL into plain space */
                                for (src=bv.bv_val,dst=abv.bv_val+abv.bv_len; *src; src++) {
-                                       if (isspace(*src)) *dst++ = ' ';
+                                       if (isspace((unsigned char)*src)) *dst++ = ' ';
                                        else *dst++ = *src;
                                }
                                *dst = '\0';
@@ -888,6 +907,12 @@ config_generic(ConfigArgs *c) {
                case CFG_LASTMOD:
                        c->value_int = (SLAP_NOLASTMOD(c->be) == 0);
                        break;
+               case CFG_MIRRORMODE:
+                       if ( SLAP_SHADOW(c->be))
+                               c->value_int = (SLAP_SINGLE_SHADOW(c->be) == 0);
+                       else
+                               rc = 1;
+                       break;
                case CFG_SSTR_IF_MAX:
                        c->value_int = index_substr_if_maxlen;
                        break;
@@ -974,6 +999,7 @@ config_generic(ConfigArgs *c) {
                case CFG_AZPOLICY:
                case CFG_DEPTH:
                case CFG_LASTMOD:
+               case CFG_MIRRORMODE:
                case CFG_SASLSECP:
                case CFG_SSTR_IF_MAX:
                case CFG_SSTR_IF_MIN:
@@ -1095,7 +1121,15 @@ config_generic(ConfigArgs *c) {
                        break;
 
                case CFG_THREADS:
-                       if ( c->value_int > 2 * SLAP_MAX_WORKER_THREADS ) {
+                       if ( c->value_int < 2 ) {
+                               snprintf( c->msg, sizeof( c->msg ),
+                                       "threads=%d smaller than minimum value 2",
+                                       c->value_int );
+                               Debug(LDAP_DEBUG_ANY, "%s: %s.\n",
+                                       c->log, c->msg, 0 );
+                               return 1;
+
+                       } else if ( c->value_int > 2 * SLAP_MAX_WORKER_THREADS ) {
                                snprintf( c->msg, sizeof( c->msg ),
                                        "warning, threads=%d larger than twice the default (2*%d=%d); YMMV",
                                        c->value_int, SLAP_MAX_WORKER_THREADS, 2 * SLAP_MAX_WORKER_THREADS );
@@ -1329,6 +1363,20 @@ config_generic(ConfigArgs *c) {
                                SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_NOLASTMOD;
                        break;
 
+               case CFG_MIRRORMODE:
+                       if(!SLAP_SHADOW(c->be)) {
+                               snprintf( c->msg, sizeof( c->msg ), "<%s> database is not a shadow",
+                                       c->argv[0] );
+                               Debug(LDAP_DEBUG_ANY, "%s: %s\n",
+                                       c->log, c->msg, 0 );
+                               return(1);
+                       }
+                       if(c->value_int)
+                               SLAP_DBFLAGS(c->be) &= ~SLAP_DBFLAG_SINGLE_SHADOW;
+                       else
+                               SLAP_DBFLAGS(c->be) |= SLAP_DBFLAG_SINGLE_SHADOW;
+                       break;
+
                case CFG_SSTR_IF_MAX:
                        if (c->value_int < index_substr_if_minlen) {
                                snprintf( c->msg, sizeof( c->msg ), "<%s> invalid value", c->argv[0] );
@@ -1373,8 +1421,8 @@ config_generic(ConfigArgs *c) {
                                char *ptr;
                                if ( c->op == SLAP_CONFIG_ADD ) {
                                        ptr = c->line + STRLENOF("moduleload");
-                                       while (!isspace(*ptr)) ptr++;
-                                       while (isspace(*ptr)) ptr++;
+                                       while (!isspace((unsigned char) *ptr)) ptr++;
+                                       while (isspace((unsigned char) *ptr)) ptr++;
                                } else {
                                        ptr = c->line;
                                }
@@ -1445,13 +1493,10 @@ config_generic(ConfigArgs *c) {
 
 
                default:
-                       Debug( SLAPD_DEBUG_CONFIG_ERROR,
-                               "%s: unknown CFG_TYPE %d"
-                               SLAPD_CONF_UNKNOWN_IGNORED ".\n",
+                       Debug( LDAP_DEBUG_ANY,
+                               "%s: unknown CFG_TYPE %d.\n",
                                c->log, c->type, 0 );
-#ifdef SLAPD_CONF_UNKNOWN_BAILOUT
                        return 1;
-#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */
 
        }
        return(0);
@@ -1597,7 +1642,7 @@ config_sizelimit(ConfigArgs *c) {
                struct berval bv;
                bv.bv_val = buf;
                bv.bv_len = 0;
-               limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv );
+               limits_unparse_one( lim, SLAP_LIMIT_SIZE, &bv, sizeof( buf ) );
                if ( !BER_BVISEMPTY( &bv ))
                        value_add_one( &c->rvalue_vals, &bv );
                else
@@ -1648,7 +1693,7 @@ config_timelimit(ConfigArgs *c) {
                struct berval bv;
                bv.bv_val = buf;
                bv.bv_len = 0;
-               limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv );
+               limits_unparse_one( lim, SLAP_LIMIT_TIME, &bv, sizeof( buf ) );
                if ( !BER_BVISEMPTY( &bv ))
                        value_add_one( &c->rvalue_vals, &bv );
                else
@@ -1696,12 +1741,10 @@ config_overlay(ConfigArgs *c) {
        }
        if(c->argv[1][0] == '-' && overlay_config(c->be, &c->argv[1][1])) {
                /* log error */
-               Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: (optional) %s overlay \"%s\" configuration failed"
-                       SLAPD_CONF_UNKNOWN_IGNORED ".\n",
+               Debug( LDAP_DEBUG_ANY,
+                       "%s: (optional) %s overlay \"%s\" configuration failed.\n",
                        c->log, c->be == frontendDB ? "global " : "", &c->argv[1][1]);
-#ifdef SLAPD_CONF_UNKNOWN_BAILOUT
                return 1;
-#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */
        } else if(overlay_config(c->be, c->argv[1])) {
                return(1);
        }
@@ -1843,13 +1886,9 @@ config_suffix(ConfigArgs *c)
        ndn = c->value_ndn;
        tbe = select_backend(&ndn, 0, 0);
        if(tbe == c->be) {
-               Debug( SLAPD_DEBUG_CONFIG_ERROR,
-                       "%s: suffix already served by this backend!"
-                       SLAPD_CONF_UNKNOWN_IGNORED ".\n",
+               Debug( LDAP_DEBUG_ANY, "%s: suffix already served by this backend!.\n",
                        c->log, 0, 0);
-#ifdef SLAPD_CONF_UNKNOWN_BAILOUT
                return 1;
-#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */
                free(pdn.bv_val);
                free(ndn.bv_val);
        } else if(tbe) {
@@ -1994,6 +2033,7 @@ config_allows(ConfigArgs *c) {
                { BER_BVC("bind_anon_cred"),    SLAP_ALLOW_BIND_ANON_CRED },
                { BER_BVC("bind_anon_dn"),      SLAP_ALLOW_BIND_ANON_DN },
                { BER_BVC("update_anon"),       SLAP_ALLOW_UPDATE_ANON },
+               { BER_BVC("proxy_authz_anon"),  SLAP_ALLOW_PROXY_AUTHZ_ANON },
                { BER_BVNULL,   0 }
        };
        if (c->op == SLAP_CONFIG_EMIT) {
@@ -2105,8 +2145,10 @@ loglevel_init( void )
                { BER_BVC("Stats2"),    LDAP_DEBUG_STATS2 },
                { BER_BVC("Shell"),     LDAP_DEBUG_SHELL },
                { BER_BVC("Parse"),     LDAP_DEBUG_PARSE },
+#if 0  /* no longer used (nor supported) */
                { BER_BVC("Cache"),     LDAP_DEBUG_CACHE },
                { BER_BVC("Index"),     LDAP_DEBUG_INDEX },
+#endif
                { BER_BVC("Sync"),      LDAP_DEBUG_SYNC },
                { BER_BVC("None"),      LDAP_DEBUG_NONE },
                { BER_BVNULL,           0 }
@@ -2172,7 +2214,7 @@ slap_loglevel_get( struct berval *s, int *l )
        rc = slap_verbmasks_append( &loglevel_ops, i, s, loglevel_ignore );
 
        if ( rc != 0 ) {
-               Debug( LDAP_DEBUG_ANY, "slap_loglevel_register(%lu, \"%s\") failed\n",
+               Debug( LDAP_DEBUG_ANY, "slap_loglevel_get(%lu, \"%s\") failed\n",
                        i, s->bv_val, 0 );
 
        } else {
@@ -2268,7 +2310,7 @@ config_loglevel(ConfigArgs *c) {
        for( i=1; i < c->argc; i++ ) {
                int     level;
 
-               if ( isdigit( c->argv[i][0] ) || c->argv[i][0] == '-' ) {
+               if ( isdigit((unsigned char)c->argv[i][0]) || c->argv[i][0] == '-' ) {
                        if( lutil_atoi( &level, c->argv[i] ) != 0 ) {
                                snprintf( c->msg, sizeof( c->msg ), "<%s> unable to parse level", c->argv[0] );
                                Debug( LDAP_DEBUG_ANY, "%s: %s \"%s\"\n",
@@ -2401,10 +2443,14 @@ config_security(ConfigArgs *c) {
 }
 
 char *
-anlist_unparse( AttributeName *an, char *ptr ) {
+anlist_unparse( AttributeName *an, char *ptr, ber_len_t buflen ) {
        int comma = 0;
+       char *start = ptr;
 
        for (; !BER_BVISNULL( &an->an_name ); an++) {
+               /* if buflen == 0, assume the buffer size has been 
+                * already checked otherwise */
+               if ( buflen > 0 && buflen - ( ptr - start ) < comma + an->an_name.bv_len ) return NULL;
                if ( comma ) *ptr++ = ',';
                ptr = lutil_strcopy( ptr, an->an_name.bv_val );
                comma = 1;
@@ -2468,7 +2514,7 @@ replica_unparse( struct slap_replica_info *ri, int i, struct berval *bv )
                ptr = lutil_strcopy( ptr, " attrs" );
                if ( ri->ri_exclude ) *ptr++ = '!';
                *ptr++ = '=';
-               ptr = anlist_unparse( ri->ri_attrs, ptr );
+               ptr = anlist_unparse( ri->ri_attrs, ptr, 0 );
        }
 }
 
@@ -2564,22 +2610,16 @@ config_replica(ConfigArgs *c) {
                        } else if(!strncasecmp(c->argv[i], "suffix=", STRLENOF( "suffix="))) {
                                switch(add_replica_suffix(c->be, nr, c->argv[i] + STRLENOF("suffix="))) {
                                        case 1:
-                                               Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: "
-                                               "suffix \"%s\" in \"replica\" line is not valid for backend"
-                                               SLAPD_CONF_UNKNOWN_IGNORED ".\n",
-                                               c->log, c->argv[i] + STRLENOF("suffix="), 0);
-#ifdef SLAPD_CONF_UNKNOWN_BAILOUT
+                                               Debug( LDAP_DEBUG_ANY, "%s: "
+                                                       "suffix \"%s\" in \"replica\" line is not valid for backend.\n",
+                                                       c->log, c->argv[i] + STRLENOF("suffix="), 0);
                                                return 1;
-#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */
                                                break;
                                        case 2:
-                                               Debug( SLAPD_DEBUG_CONFIG_ERROR, "%s: "
-                                               "unable to normalize suffix in \"replica\" line"
-                                               SLAPD_CONF_UNKNOWN_IGNORED ".\n",
-                                               c->log, 0, 0);
-#ifdef SLAPD_CONF_UNKNOWN_BAILOUT
+                                               Debug( LDAP_DEBUG_ANY, "%s: "
+                                                       "unable to normalize suffix in \"replica\" line.\n",
+                                                       c->log, 0, 0);
                                                return 1;
-#endif /* SLAPD_CONF_UNKNOWN_BAILOUT */
                                                break;
                                }
 
@@ -2672,7 +2712,7 @@ config_shadow( ConfigArgs *c, int flag )
                return 1;
        }
 
-       SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | flag);
+       SLAP_DBFLAGS(c->be) |= (SLAP_DBFLAG_SHADOW | SLAP_DBFLAG_SINGLE_SHADOW | flag);
 
        return 0;
 }
@@ -2761,8 +2801,9 @@ config_include(ConfigArgs *c) {
 static int
 config_tls_option(ConfigArgs *c) {
        int flag;
+       LDAP *ld = slap_tls_ld;
        switch(c->type) {
-       case CFG_TLS_RAND:      flag = LDAP_OPT_X_TLS_RANDOM_FILE;      break;
+       case CFG_TLS_RAND:      flag = LDAP_OPT_X_TLS_RANDOM_FILE;      ld = NULL; break;
        case CFG_TLS_CIPHER:    flag = LDAP_OPT_X_TLS_CIPHER_SUITE;     break;
        case CFG_TLS_CERT_FILE: flag = LDAP_OPT_X_TLS_CERTFILE;         break;  
        case CFG_TLS_CERT_KEY:  flag = LDAP_OPT_X_TLS_KEYFILE;          break;
@@ -2775,12 +2816,12 @@ config_tls_option(ConfigArgs *c) {
                return 1;
        }
        if (c->op == SLAP_CONFIG_EMIT) {
-               return ldap_pvt_tls_get_option( NULL, flag, &c->value_string );
+               return ldap_pvt_tls_get_option( ld, flag, &c->value_string );
        } else if ( c->op == LDAP_MOD_DELETE ) {
-               return ldap_pvt_tls_set_option( NULL, flag, NULL );
+               return ldap_pvt_tls_set_option( ld, flag, NULL );
        }
        ch_free(c->value_string);
-       return(ldap_pvt_tls_set_option(NULL, flag, c->argv[1]));
+       return(ldap_pvt_tls_set_option(ld, flag, c->argv[1]));
 }
 
 /* FIXME: this ought to be provided by libldap */
@@ -2810,7 +2851,7 @@ config_tls_config(ConfigArgs *c) {
                return 1;
        }
        if (c->op == SLAP_CONFIG_EMIT) {
-               ldap_pvt_tls_get_option( NULL, flag, &c->value_int );
+               ldap_pvt_tls_get_option( slap_tls_ld, flag, &c->value_int );
                for (i=0; !BER_BVISNULL(&keys[i].word); i++) {
                        if (keys[i].mask == c->value_int) {
                                c->value_string = ch_strdup( keys[i].word.bv_val );
@@ -2820,7 +2861,7 @@ config_tls_config(ConfigArgs *c) {
                return 1;
        } else if ( c->op == LDAP_MOD_DELETE ) {
                int i = 0;
-               return ldap_pvt_tls_set_option( NULL, flag, &i );
+               return ldap_pvt_tls_set_option( slap_tls_ld, flag, &i );
        }
        ch_free( c->value_string );
        if ( isdigit( (unsigned char)c->argv[1][0] ) ) {
@@ -2830,9 +2871,9 @@ config_tls_config(ConfigArgs *c) {
                                c->log, c->argv[0], c->argv[1] );
                        return 1;
                }
-               return(ldap_pvt_tls_set_option(NULL, flag, &i));
+               return(ldap_pvt_tls_set_option(slap_tls_ld, flag, &i));
        } else {
-               return(ldap_int_tls_config(NULL, flag, c->argv[1]));
+               return(ldap_int_tls_config(slap_tls_ld, flag, c->argv[1]));
        }
 }
 #endif
@@ -3614,9 +3655,19 @@ config_add_internal( CfBackInfo *cfb, Entry *e, ConfigArgs *ca, SlapReply *rs, i
         * These entries can have auto-assigned indexes (appended to the end)
         * but only the other types support auto-renumbering of siblings.
         */
-       rc = check_name_index( last, colst[0]->co_type, e, rs, renum );
-       if ( rc )
-               goto done;
+       {
+               int renumber = renum ? *renum : 0;
+               rc = check_name_index( last, colst[0]->co_type, e, rs, renum );
+               if ( rc ) {
+                       goto done;
+               }
+               if ( renum && *renum && renumber == -1 ) {
+                       snprintf( ca->msg, sizeof( ca->msg ),
+                               "operation requires sibling renumbering" );
+                       rc = LDAP_UNWILLING_TO_PERFORM;
+                       goto done;
+               }
+       }
 
        init_config_argv( ca );
 
@@ -3734,10 +3785,15 @@ config_back_add( Operation *op, SlapReply *rs )
         * 4) store entry in underlying database
         * 5) perform any necessary renumbering
         */
+       /* NOTE: by now we do not accept adds that require renumbering */
+       renumber = -1;
        rs->sr_err = config_add_internal( cfb, op->ora_e, &ca, rs, &renumber );
        if ( rs->sr_err != LDAP_SUCCESS ) {
                rs->sr_text = ca.msg;
-       } else if ( cfb->cb_use_ldif ) {
+               goto out2;
+       }
+
+       if ( cfb->cb_use_ldif ) {
                BackendDB *be = op->o_bd;
                slap_callback sc = { NULL, slap_null_cb, NULL, NULL };
                struct berval dn, ndn;
@@ -3758,12 +3814,15 @@ config_back_add( Operation *op, SlapReply *rs )
                op->o_dn = dn;
                op->o_ndn = ndn;
        }
+
        if ( renumber ) {
+               /* TODO */
        }
 
+out2:;
        ldap_pvt_thread_pool_resume( &connection_pool );
 
-out:
+out:;
        send_ldap_result( op, rs );
        return rs->sr_err;
 }
@@ -3800,6 +3859,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs,
        ca->bi = ce->ce_bi;
        ca->private = ce->ce_private;
        ca->ca_entry = e;
+       ca->fname = "slapd";
        strcpy( ca->log, "back-config" );
 
        for (ml = op->orm_modlist; ml; ml=ml->sml_next) {
@@ -4026,6 +4086,11 @@ out:
        }
        ch_free( ca->argv );
        if ( colst ) ch_free( colst );
+       while( dels ) {
+               deltail = dels->next;
+               ch_free( dels );
+               dels = deltail;
+       }
 
        return rc;
 }
@@ -4140,6 +4205,9 @@ config_back_modrdn( Operation *op, SlapReply *rs )
        }
        ldap_pvt_thread_pool_pause( &connection_pool );
 
+       rs->sr_err = LDAP_UNWILLING_TO_PERFORM;
+       rs->sr_text = "renaming not implemented yet within naming context";
+
        ldap_pvt_thread_pool_resume( &connection_pool );
 out:
        send_ldap_result( op, rs );
@@ -4198,7 +4266,9 @@ config_build_attrs( Entry *e, AttributeType **at, AttributeDescription *ad,
                for (i=0;ct[i].name;i++) {
                        if (ct[i].ad == (*at)->sat_ad) {
                                rc = config_get_vals(&ct[i], c);
-                               if (rc == LDAP_SUCCESS) {
+                               /* NOTE: tolerate that config_get_vals()
+                                * returns success with no values */
+                               if (rc == LDAP_SUCCESS && c->rvalue_vals != NULL ) {
                                        if ( c->rvalue_nvals )
                                                attr_merge(e, ct[i].ad, c->rvalue_vals,
                                                        c->rvalue_nvals);
@@ -4231,6 +4301,7 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent,
        ObjectClass *oc;
        CfEntryInfo *ceprev = NULL;
 
+       Debug( LDAP_DEBUG_TRACE, "config_build_entry: \"%s\"\n", rdn->bv_val, 0, 0);
        e->e_private = ce;
        ce->ce_entry = e;
        ce->ce_parent = parent;
@@ -4290,6 +4361,10 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent,
        if ( op ) {
                op->ora_e = e;
                op->o_bd->be_add( op, rs );
+               if ( ( rs->sr_err != LDAP_SUCCESS ) 
+                               && (rs->sr_err != LDAP_ALREADY_EXISTS) ) {
+                       return NULL;
+               }
        }
        if ( ceprev ) {
                ceprev->ce_sibs = ce;
@@ -4300,7 +4375,7 @@ config_build_entry( Operation *op, SlapReply *rs, CfEntryInfo *parent,
        return e;
 }
 
-static void
+static int
 config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent,
        Operation *op, SlapReply *rs )
 {
@@ -4324,7 +4399,7 @@ config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent,
                c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=" SLAP_X_ORDERED_FMT, c->depth);
                if ( c->value_dn.bv_len >= sizeof( c->log ) ) {
                        /* FIXME: how can indicate error? */
-                       return;
+                       return -1;
                }
                strncpy( c->value_dn.bv_val + c->value_dn.bv_len, bv.bv_val,
                        bv.bv_len );
@@ -4334,14 +4409,17 @@ config_build_schema_inc( ConfigArgs *c, CfEntryInfo *ceparent,
                c->private = cf;
                e = config_build_entry( op, rs, ceparent, c, &c->value_dn,
                        &CFOC_SCHEMA, NULL );
-               if ( e && cf->c_kids ) {
+               if ( !e ) {
+                       return -1;
+               } else if ( e && cf->c_kids ) {
                        c->private = cf->c_kids;
                        config_build_schema_inc( c, e->e_private, op, rs );
                }
        }
+       return 0;
 }
 
-static void
+static int
 config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent,
        Operation *op, SlapReply *rs )
 {
@@ -4354,21 +4432,24 @@ config_build_includes( ConfigArgs *c, CfEntryInfo *ceparent,
                c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=include" SLAP_X_ORDERED_FMT, i);
                if ( c->value_dn.bv_len >= sizeof( c->log ) ) {
                        /* FIXME: how can indicate error? */
-                       return;
+                       return -1;
                }
                c->private = cf;
                e = config_build_entry( op, rs, ceparent, c, &c->value_dn,
                        &CFOC_INCLUDE, NULL );
-               if ( e && cf->c_kids ) {
+               if ( ! e ) {
+                       return -1;
+               } else if ( e && cf->c_kids ) {
                        c->private = cf->c_kids;
                        config_build_includes( c, e->e_private, op, rs );
                }
        }
+       return 0;
 }
 
 #ifdef SLAPD_MODULES
 
-static void
+static int
 config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent,
        Operation *op, SlapReply *rs )
 {
@@ -4382,12 +4463,14 @@ config_build_modules( ConfigArgs *c, CfEntryInfo *ceparent,
                c->value_dn.bv_len = snprintf(c->value_dn.bv_val, sizeof( c->log ), "cn=module" SLAP_X_ORDERED_FMT, i);
                if ( c->value_dn.bv_len >= sizeof( c->log ) ) {
                        /* FIXME: how can indicate error? */
-                       return;
+                       return -1;
                }
                c->private = mp;
-               config_build_entry( op, rs, ceparent, c, &c->value_dn,
-                       &CFOC_MODULE, NULL );
+               if ( ! config_build_entry( op, rs, ceparent, c, &c->value_dn, &CFOC_MODULE, NULL )) {
+                       return -1;
+               }
        }
+        return 0;
 }
 #endif
 
@@ -4408,6 +4491,7 @@ config_back_db_open( BackendDB *be )
        SlapReply rs = {REP_RESULT};
        void *thrctx = NULL;
 
+       Debug( LDAP_DEBUG_TRACE, "config_back_db_open\n", 0, 0, 0);
        /* If we read the config from back-ldif, nothing to do here */
        if ( cfb->cb_got_ldif )
                return 0;
@@ -4431,6 +4515,9 @@ config_back_db_open( BackendDB *be )
        c.private = cfb->cb_config;
        c.be = frontendDB;
        e = config_build_entry( op, &rs, NULL, &c, &rdn, &CFOC_GLOBAL, NULL );
+       if ( !e ) {
+               return -1;
+       }
        ce = e->e_private;
        cfb->cb_root = ce;
 
@@ -4441,13 +4528,17 @@ config_back_db_open( BackendDB *be )
        if ( cfb->cb_config->c_kids ) {
                c.depth = 0;
                c.private = cfb->cb_config->c_kids;
-               config_build_includes( &c, ceparent, op, &rs );
+               if ( config_build_includes( &c, ceparent, op, &rs ) ) {
+                       return -1;
+               }
        }
 
 #ifdef SLAPD_MODULES
        /* Create Module nodes... */
        if ( modpaths.mp_loads ) {
-               config_build_modules( &c, ceparent, op, &rs );
+               if ( config_build_modules( &c, ceparent, op, &rs ) ){
+                       return -1;
+               }
        }
 #endif
 
@@ -4458,13 +4549,18 @@ config_back_db_open( BackendDB *be )
        rdn = schema_rdn;
        c.private = NULL;
        e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_SCHEMA, NULL );
+       if ( !e ) {
+               return -1;
+       }
        ce = e->e_private;
 
        /* Create schema nodes for included schema... */
        if ( cfb->cb_config->c_kids ) {
                c.depth = 0;
                c.private = cfb->cb_config->c_kids;
-               config_build_schema_inc( &c, ce, op, &rs );
+               if (config_build_schema_inc( &c, ce, op, &rs )) {
+                       return -1;
+               }
        }
 
        /* Create backend nodes. Skip if they don't provide a cf_table.
@@ -4494,6 +4590,9 @@ config_back_db_open( BackendDB *be )
                c.bi = bi;
                e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_BACKEND,
                        bi->bi_cf_ocs );
+               if ( !e ) {
+                       return -1;
+               }
        }
 
        /* Create database nodes... */
@@ -4530,6 +4629,9 @@ config_back_db_open( BackendDB *be )
                c.bi = bi;
                e = config_build_entry( op, &rs, ceparent, &c, &rdn, &CFOC_DATABASE,
                        be->be_cf_ocs );
+               if ( !e ) {
+                       return -1;
+               }
                ce = e->e_private;
                if ( be->be_cf_ocs && be->be_cf_ocs->co_cfadd )
                        be->be_cf_ocs->co_cfadd( op, &rs, e, &c );
@@ -4557,6 +4659,9 @@ config_back_db_open( BackendDB *be )
                                c.bi = &on->on_bi;
                                oe = config_build_entry( op, &rs, ce, &c, &rdn,
                                        &CFOC_OVERLAY, c.bi->bi_cf_ocs );
+                               if ( !oe ) {
+                                       return -1;
+                               }
                                if ( c.bi->bi_cf_ocs && c.bi->bi_cf_ocs->co_cfadd )
                                        c.bi->bi_cf_ocs->co_cfadd( op, &rs, oe, &c );
                        }
@@ -4798,6 +4903,9 @@ config_back_initialize( BackendInfo *bi )
                NULL
        };
 
+       /* Make sure we don't exceed the bits reserved for userland */
+       config_check_userland( CFG_LAST );
+
        bi->bi_controls = controls;
 
        bi->bi_open = 0;
@@ -4825,9 +4933,7 @@ config_back_initialize( BackendInfo *bi )
 
        bi->bi_chk_referrals = 0;
 
-#ifdef SLAP_OVERLAY_ACCESS
        bi->bi_access_allowed = slap_access_always_allowed;
-#endif /* SLAP_OVERLAY_ACCESS */
 
        bi->bi_connection_init = 0;
        bi->bi_connection_destroy = 0;
@@ -4839,9 +4945,6 @@ config_back_initialize( BackendInfo *bi )
        bi->bi_tool_entry_get = config_tool_entry_get;
        bi->bi_tool_entry_put = config_tool_entry_put;
 
-       /* Make sure we don't exceed the bits reserved for userland */
-       assert( ( ( CFG_LAST - 1 ) & ARGS_USERLAND ) == ( CFG_LAST - 1 ) );
-
        argv[3] = NULL;
        for (i=0; OidMacros[i].name; i++ ) {
                argv[1] = OidMacros[i].name;