don't return entry if requested attr is not present (ITS#5650)

[openldap] / servers / slapd / syncrepl.c

diff --git a/servers/slapd/syncrepl.c b/servers/slapd/syncrepl.c
index fd8847727c0a09a3571d82ec7b7505f8be0cff68..4378ee9383d7880e95108fbb13a01329d1c40af3 100644 (file)
--- a/servers/slapd/syncrepl.c
+++ b/servers/slapd/syncrepl.c
@@ -579,6 +579,9 @@ do_syncrep1(
 
        ldap_set_option( si->si_ld, LDAP_OPT_TIMELIMIT, &si->si_tlimit );
 
+       rc = LDAP_DEREF_NEVER;  /* actually could allow DEREF_FINDING */
+       ldap_set_option( si->si_ld, LDAP_OPT_DEREF, &rc );
+
        si->si_syncCookie.rid = si->si_rid;
 
        /* whenever there are multiple data sources possible, advertise sid */
@@ -689,8 +692,8 @@ compare_csns( struct sync_cookie *sc1, struct sync_cookie *sc2, int *which )
                return -1;
        }
 
-       for (i=0; i<sc1->numcsns; i++) {
-               for (j=0; j<sc2->numcsns; j++) {
+       for (j=0; j<sc2->numcsns; j++) {
+               for (i=0; i<sc1->numcsns; i++) {
                        if ( sc1->sids[i] != sc2->sids[j] )
                                continue;
                        value_match( &match, slap_schema.si_ad_entryCSN,
@@ -703,6 +706,11 @@ compare_csns( struct sync_cookie *sc1, struct sync_cookie *sc2, int *which )
                        }
                        break;
                }
+               if ( i == sc1->numcsns ) {
+                       /* sc2 has a sid sc1 lacks */
+                       *which = j;
+                       return -1;
+               }
        }
        return match;
 }
@@ -906,6 +914,11 @@ do_syncrep2(
                                rc = err;
                                goto done;
                        }
+                       if ( err ) {
+                               Debug( LDAP_DEBUG_ANY,
+                                       "do_syncrep2: %s LDAP_RES_SEARCH_RESULT (%d) %s\n",
+                                       si->si_ridtxt, err, ldap_err2string( err ) );
+                       }
                        if ( rctrls ) {
                                rctrlp = *rctrls;
                                ber_init2( ber, &rctrlp->ldctl_value, LBER_USE_DER );
@@ -2878,6 +2891,14 @@ attr_cmp( Operation *op, Attribute *old, Attribute *new,
                        }
                }
 
+               /* Don't delete/add an objectClass, always use the replace op.
+                * Modify would fail if provider has replaced entry with a new,
+                * and the new explicitly includes a superior of a class that was
+                * only included implicitly in the old entry.  Ref ITS#5517.
+                */
+               if ( nn && no < o && old->a_desc == slap_schema.si_ad_objectClass )
+                       no = o;
+
                i = j;
                /* all old values were deleted, just use the replace op */
                if ( no == o ) {