X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=servers%2Fslapd%2Facl.c;h=9fb688e86947fac5ef52ea1c138fdaef9ff86f87;hb=54fa643a9bd33e59059b84bda010b5f668cd45bb;hp=073a1cafebc24980b38addfd6f6d119bf26e47c6;hpb=e79fbb88cf67006c8be2f87ea9725bf03970861f;p=openldap

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index 073a1cafeb..9fb688e869 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -2,7 +2,7 @@
 /* $OpenLDAP$ */
 /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
  *
- * Copyright 1998-2004 The OpenLDAP Foundation.
+ * Copyright 1998-2005 The OpenLDAP Foundation.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -35,6 +35,7 @@
 #include "slap.h"
 #include "sets.h"
 #include "lber_pvt.h"
+#include "lutil.h"
 
 #ifdef LDAP_SLAPI
 #include "slapi/slapi.h"
@@ -48,11 +49,14 @@
 static struct berval 
 	aci_bv_entry 		= BER_BVC("entry"),
 	aci_bv_children 	= BER_BVC("children"),
+	aci_bv_onelevel 	= BER_BVC("onelevel"),
 	aci_bv_subtree 		= BER_BVC("subtree"),
 	aci_bv_br_entry		= BER_BVC("[entry]"),
 	aci_bv_br_all		= BER_BVC("[all]"),
 	aci_bv_access_id 	= BER_BVC("access-id"),
+#if 0
 	aci_bv_anonymous	= BER_BVC("anonymous"),
+#endif
 	aci_bv_public		= BER_BVC("public"),
 	aci_bv_users		= BER_BVC("users"),
 	aci_bv_self 		= BER_BVC("self"),
@@ -67,7 +71,9 @@ static struct berval
 	aci_bv_ip_eq		= BER_BVC("IP="),
 #ifdef LDAP_PF_LOCAL
 	aci_bv_path_eq		= BER_BVC("PATH="),
+#if 0
 	aci_bv_dirsep		= BER_BVC(LDAP_DIRSEP),
+#endif
 #endif /* LDAP_PF_LOCAL */
 	
 	aci_bv_group_class 	= BER_BVC(SLAPD_GROUP_CLASS),
@@ -82,7 +88,7 @@ typedef enum slap_aci_scope_t {
 	SLAP_ACI_SCOPE_SUBTREE		= ( SLAP_ACI_SCOPE_ENTRY | SLAP_ACI_SCOPE_CHILDREN )
 } slap_aci_scope_t;
 
-static AccessControl * acl_get(
+static AccessControl * slap_acl_get(
 	AccessControl *ac, int *count,
 	Operation *op, Entry *e,
 	AttributeDescription *desc,
@@ -90,7 +96,7 @@ static AccessControl * acl_get(
 	int nmatch, regmatch_t *matches,
 	AccessControlState *state );
 
-static slap_control_t acl_mask(
+static slap_control_t slap_acl_mask(
 	AccessControl *ac, slap_mask_t *mask,
 	Operation *op, Entry *e,
 	AttributeDescription *desc,
@@ -111,7 +117,7 @@ static int aci_mask(
 	slap_access_t *grant,
 	slap_access_t *deny,
 	slap_aci_scope_t scope);
-#endif
+#endif /* SLAPD_ACI_ENABLED */
 
 static int	regex_matches(
 	struct berval *pat, char *str, char *buf,
@@ -136,7 +142,7 @@ static int aci_match_set ( struct berval *subj, Operation *op,
  * the whole attribute is assumed (all values).
  *
  * This routine loops through all access controls and calls
- * acl_mask() on each applicable access control.
+ * slap_acl_mask() on each applicable access control.
  * The loop exits when a definitive answer is reached or
  * or no more controls remain.
  *
@@ -149,6 +155,340 @@ static int aci_match_set ( struct berval *subj, Operation *op,
  * - can be legally called with op->o_bd == NULL
  */
 
+#ifdef SLAP_OVERLAY_ACCESS
+int
+slap_access_always_allowed(
+	Operation		*op,
+	Entry			*e,
+	AttributeDescription	*desc,
+	struct berval		*val,
+	slap_access_t		access,
+	AccessControlState	*state,
+	slap_mask_t		*maskp )
+{
+	assert( maskp );
+
+	ACL_PRIV_SET( *maskp, ACL_ACCESS2PRIV( access ) );
+
+	return 1;
+}
+
+int
+slap_access_allowed(
+	Operation		*op,
+	Entry			*e,
+	AttributeDescription	*desc,
+	struct berval		*val,
+	slap_access_t		access,
+	AccessControlState	*state,
+	slap_mask_t		*maskp )
+{
+	int				ret = 1;
+	int				count;
+	AccessControl			*a = NULL;
+
+#ifdef LDAP_DEBUG
+	char				accessmaskbuf[ACCESSMASK_MAXLEN];
+#endif
+	slap_mask_t			mask;
+	slap_control_t			control;
+	slap_access_t			access_level;
+	const char			*attr;
+	regmatch_t			matches[MAXREMATCHES];
+	int				st_same_attr = 0;
+
+	assert( op != NULL );
+	assert( e != NULL );
+	assert( desc != NULL );
+	assert( maskp != NULL );
+
+	access_level = ACL_LEVEL( access );
+	attr = desc->ad_cname.bv_val;
+
+	assert( attr != NULL );
+
+#ifdef LDAP_SLAPI
+	if ( op->o_pb != NULL ) {
+		ret = slapi_int_access_allowed( op, e, desc, val, access, state );
+		if ( ret == 0 ) {
+			/* ACL plugin denied access */
+			goto done;
+		}
+	}
+#endif /* LDAP_SLAPI */
+
+	/* grant database root access */
+	if ( be_isroot( op ) ) {
+		Debug( LDAP_DEBUG_ACL, "<= root access granted\n", 0, 0, 0 );
+		mask = ACL_LVL_MANAGE;
+		goto done;
+	}
+
+	/*
+	 * no-user-modification operational attributes are ignored
+	 * by ACL_WRITE checking as any found here are not provided
+	 * by the user
+	 */
+	if ( access_level >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
+		&& desc != slap_schema.si_ad_entry
+		&& desc != slap_schema.si_ad_children )
+	{
+		Debug( LDAP_DEBUG_ACL, "NoUserMod Operational attribute:"
+			" %s access granted\n",
+			attr, 0, 0 );
+		goto done;
+	}
+
+	/* use backend default access if no backend acls */
+	if ( op->o_bd->be_acl == NULL ) {
+		int	i;
+
+		Debug( LDAP_DEBUG_ACL,
+			"=> slap_access_allowed: backend default %s "
+			"access %s to \"%s\"\n",
+			access2str( access ),
+			op->o_bd->be_dfltaccess >= access_level ? "granted" : "denied",
+			op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" );
+		ret = op->o_bd->be_dfltaccess >= access_level;
+
+		mask = ACL_PRIV_LEVEL;
+		for ( i = ACL_NONE; i <= op->o_bd->be_dfltaccess; i++ ) {
+			ACL_PRIV_SET( mask, ACL_ACCESS2PRIV( i ) );
+		}
+
+		goto done;
+	}
+
+	ret = 0;
+	control = ACL_BREAK;
+
+	if ( st_same_attr ) {
+		assert( state->as_vd_acl != NULL );
+
+		a = state->as_vd_acl;
+		count = state->as_vd_acl_count;
+		if ( !ACL_IS_INVALID( state->as_vd_acl_mask ) ) {
+			mask = state->as_vd_acl_mask;
+			AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
+			goto vd_access;
+		}
+
+	} else {
+		if ( state ) state->as_vi_acl = NULL;
+		a = NULL;
+		ACL_PRIV_ASSIGN( mask, *maskp );
+		count = 0;
+		memset( matches, '\0', sizeof( matches ) );
+	}
+
+	while ( ( a = slap_acl_get( a, &count, op, e, desc, val,
+		MAXREMATCHES, matches, state ) ) != NULL )
+	{
+		int i;
+
+		for ( i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++ ) {
+			Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
+				(int)matches[i].rm_so, (int)matches[i].rm_eo );
+			if ( matches[i].rm_so <= matches[0].rm_eo ) {
+				int n;
+				for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++ ) {
+					Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
+				}
+			}
+			Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
+		}
+
+		if ( state ) {
+			if ( state->as_vi_acl == a &&
+				( state->as_recorded & ACL_STATE_RECORDED_NV ) )
+			{
+				Debug( LDAP_DEBUG_ACL,
+					"=> slap_access_allowed: result from state (%s)\n",
+					attr, 0, 0 );
+				ret = state->as_result;
+				goto done;
+			} else {
+				Debug( LDAP_DEBUG_ACL,
+					"=> slap_access_allowed: no res from state (%s)\n",
+					attr, 0, 0 );
+			}
+		}
+
+vd_access:
+		control = slap_acl_mask( a, &mask, op,
+			e, desc, val, MAXREMATCHES, matches, count, state );
+
+		if ( control != ACL_BREAK ) {
+			break;
+		}
+
+		memset( matches, '\0', sizeof( matches ) );
+	}
+
+	if ( ACL_IS_INVALID( mask ) ) {
+		Debug( LDAP_DEBUG_ACL,
+			"=> slap_access_allowed: \"%s\" (%s) invalid!\n",
+			e->e_dn, attr, 0 );
+		ACL_PRIV_ASSIGN( mask, *maskp );
+
+	} else if ( control == ACL_BREAK ) {
+		Debug( LDAP_DEBUG_ACL,
+			"=> slap_access_allowed: no more rules\n", 0, 0, 0 );
+
+		goto done;
+	}
+
+	ret = ACL_GRANT( mask, access );
+
+	Debug( LDAP_DEBUG_ACL,
+		"=> slap_access_allowed: %s access %s by %s\n",
+		access2str( access ), ret ? "granted" : "denied",
+		accessmask2str( mask, accessmaskbuf, 1 ) );
+
+done:
+	ACL_PRIV_ASSIGN( *maskp, mask );
+	return ret;
+}
+
+int
+access_allowed_mask(
+	Operation		*op,
+	Entry			*e,
+	AttributeDescription	*desc,
+	struct berval		*val,
+	slap_access_t		access,
+	AccessControlState	*state,
+	slap_mask_t		*maskp )
+{
+	int				ret = 1;
+	AccessControl			*a = NULL;
+	int				be_null = 0;
+
+#ifdef LDAP_DEBUG
+	char				accessmaskbuf[ACCESSMASK_MAXLEN];
+#endif
+	slap_mask_t			mask;
+	slap_control_t			control;
+	slap_access_t			access_level;
+	const char			*attr;
+	int				st_same_attr = 0;
+	static AccessControlState	state_init = ACL_STATE_INIT;
+	BI_access_allowed		*bi_access_allowed = NULL;
+
+	assert( e != NULL );
+	assert( desc != NULL );
+
+	access_level = ACL_LEVEL( access );
+
+	assert( access_level > ACL_NONE );
+
+	ACL_INIT( mask );
+	if ( maskp ) ACL_INVALIDATE( *maskp );
+
+	attr = desc->ad_cname.bv_val;
+
+	assert( attr != NULL );
+
+	if ( op && op->o_is_auth_check &&
+		( access_level == ACL_SEARCH || access_level == ACL_READ ) )
+	{
+		access = ACL_AUTH;
+	}
+
+	if ( state ) {
+		if ( state->as_vd_ad == desc ) {
+			if ( state->as_recorded ) {
+				if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) &&
+					val == NULL )
+				{
+					return state->as_result;
+
+				} else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) &&
+					val != NULL && state->as_vd_acl == NULL )
+				{
+					return state->as_result;
+				}
+			}
+			st_same_attr = 1;
+		} else {
+			*state = state_init;
+		}
+
+		state->as_vd_ad = desc;
+	}
+
+	Debug( LDAP_DEBUG_ACL,
+		"=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
+		access2str( access ), e->e_dn, attr );
+
+	if ( op == NULL ) {
+		/* no-op call */
+		goto done;
+	}
+
+	if ( op->o_bd == NULL ) {
+		op->o_bd = LDAP_STAILQ_FIRST( &backendDB );
+		be_null = 1;
+
+#ifdef LDAP_DEVEL
+		/*
+		 * FIXME: experimental; use first backend rules
+		 * iff there is no global_acl (ITS#3100) */
+		if ( frontendDB->be_acl != NULL ) {
+			op->o_bd = frontendDB;
+		}
+#endif /* LDAP_DEVEL */
+	}
+	assert( op->o_bd != NULL );
+
+	/* this is enforced in backend_add() */
+	if ( op->o_bd->bd_info->bi_access_allowed ) {
+		/* delegate to backend */
+		ret = op->o_bd->bd_info->bi_access_allowed( op, e, desc, val, access, state, &mask );
+
+	} else {
+		/* use default */
+		ret = slap_access_allowed( op, e, desc, val, access, state, &mask );
+	}
+
+	if ( !ret ) {
+		if ( ACL_IS_INVALID( mask ) ) {
+			Debug( LDAP_DEBUG_ACL,
+				"=> access_allowed: \"%s\" (%s) invalid!\n",
+				e->e_dn, attr, 0 );
+			ACL_INIT( mask );
+
+		} else if ( control == ACL_BREAK ) {
+			Debug( LDAP_DEBUG_ACL,
+				"=> access_allowed: no more rules\n", 0, 0, 0 );
+
+			goto done;
+		}
+
+		ret = ACL_GRANT( mask, access );
+	}
+
+	Debug( LDAP_DEBUG_ACL,
+		"=> access_allowed: %s access %s by %s\n",
+		access2str( access ), ret ? "granted" : "denied",
+		accessmask2str( mask, accessmaskbuf, 1 ) );
+
+done:
+	if ( state != NULL ) {
+		/* If not value-dependent, save ACL in case of more attrs */
+		if ( !( state->as_recorded & ACL_STATE_RECORDED_VD ) ) {
+			state->as_vi_acl = a;
+			state->as_result = ret;
+		}
+		state->as_recorded |= ACL_STATE_RECORDED;
+	}
+	if ( be_null ) op->o_bd = NULL;
+	if ( maskp ) ACL_PRIV_ASSIGN( *maskp, mask );
+	return ret;
+}
+
+#else /* !SLAP_OVERLAY_ACCESS */
+
 int
 access_allowed_mask(
 	Operation		*op,
@@ -162,42 +502,47 @@ access_allowed_mask(
 	int				ret = 1;
 	int				count;
 	AccessControl			*a = NULL;
-	Backend *be;
-	int	be_null = 0;
+	Backend				*be;
+	int				be_null = 0;
 
 #ifdef LDAP_DEBUG
-	char accessmaskbuf[ACCESSMASK_MAXLEN];
+	char				accessmaskbuf[ACCESSMASK_MAXLEN];
 #endif
-	slap_mask_t mask;
-	slap_control_t control;
-	const char *attr;
-	regmatch_t matches[MAXREMATCHES];
-	int        st_same_attr = 0;
-	static AccessControlState state_init = ACL_STATE_INIT;
+	slap_mask_t			mask;
+	slap_control_t			control;
+	slap_access_t			access_level;
+	const char			*attr;
+	regmatch_t			matches[MAXREMATCHES];
+	int				st_same_attr = 0;
+	static AccessControlState	state_init = ACL_STATE_INIT;
 
 	assert( e != NULL );
 	assert( desc != NULL );
-	assert( access > ACL_NONE );
+
+	access_level = ACL_LEVEL( access );
+
+	assert( access_level > ACL_NONE );
 	if ( maskp ) ACL_INVALIDATE( *maskp );
 
 	attr = desc->ad_cname.bv_val;
 
 	assert( attr != NULL );
 
-	if( op && op->o_is_auth_check &&
-		( access == ACL_SEARCH || access == ACL_READ ))
+	if ( op && op->o_is_auth_check &&
+		( access_level == ACL_SEARCH || access_level == ACL_READ ) )
 	{
 		access = ACL_AUTH;
 	}
 
-	if( state ) {
-		if ( state->as_vd_ad==desc) {
+	if ( state ) {
+		if ( state->as_vd_ad == desc ) {
 			if ( state->as_recorded ) {
-				if( state->as_recorded & ACL_STATE_RECORDED_NV &&
+				if ( ( state->as_recorded & ACL_STATE_RECORDED_NV ) &&
 					val == NULL )
 				{
 					return state->as_result;
-				} else if ( state->as_recorded & ACL_STATE_RECORDED_VD &&
+
+				} else if ( ( state->as_recorded & ACL_STATE_RECORDED_VD ) &&
 					val != NULL && state->as_vd_acl == NULL )
 				{
 					return state->as_result;
@@ -213,7 +558,7 @@ access_allowed_mask(
 
 	Debug( LDAP_DEBUG_ACL,
 		"=> access_allowed: %s access to \"%s\" \"%s\" requested\n",
-	    access2str( access ), e->e_dn, attr );
+		access2str( access ), e->e_dn, attr );
 
 	if ( op == NULL ) {
 		/* no-op call */
@@ -222,7 +567,7 @@ access_allowed_mask(
 
 	be = op->o_bd;
 	if ( be == NULL ) {
-		be = &backends[0];
+		be = LDAP_STAILQ_FIRST(&backendDB);
 		be_null = 1;
 #ifdef LDAP_DEVEL
 		/*
@@ -247,12 +592,10 @@ access_allowed_mask(
 #endif /* LDAP_SLAPI */
 
 	/* grant database root access */
-	if ( be != NULL && be_isroot( op ) ) {
-		Debug( LDAP_DEBUG_ACL,
-		    "<= root access granted\n",
-			0, 0, 0 );
+	if ( be_isroot( op ) ) {
+		Debug( LDAP_DEBUG_ACL, "<= root access granted\n", 0, 0, 0 );
 		if ( maskp ) {
-			mask = ACL_LVL_WRITE;
+			mask = ACL_LVL_MANAGE;
 		}
 
 		goto done;
@@ -263,7 +606,7 @@ access_allowed_mask(
 	 * by ACL_WRITE checking as any found here are not provided
 	 * by the user
 	 */
-	if ( access >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
+	if ( access_level >= ACL_WRITE && is_at_no_user_mod( desc->ad_type )
 		&& desc != slap_schema.si_ad_entry
 		&& desc != slap_schema.si_ad_children )
 	{
@@ -274,13 +617,14 @@ access_allowed_mask(
 	}
 
 	/* use backend default access if no backend acls */
-	if( be != NULL && be->be_acl == NULL ) {
+	if ( be->be_acl == NULL ) {
 		Debug( LDAP_DEBUG_ACL,
-			"=> access_allowed: backend default %s access %s to \"%s\"\n",
+			"=> access_allowed: backend default %s "
+			"access %s to \"%s\"\n",
 			access2str( access ),
-			be->be_dfltaccess >= access ? "granted" : "denied",
+			be->be_dfltaccess >= access_level ? "granted" : "denied",
 			op->o_dn.bv_val ? op->o_dn.bv_val : "(anonymous)" );
-		ret = be->be_dfltaccess >= access;
+		ret = be->be_dfltaccess >= access_level;
 
 		if ( maskp ) {
 			int	i;
@@ -300,8 +644,9 @@ access_allowed_mask(
 		Debug( LDAP_DEBUG_ACL,
 			"=> access_allowed: global default %s access %s to \"%s\"\n",
 			access2str( access ),
-			frontendDB->be_dfltaccess >= access ? "granted" : "denied", op->o_dn.bv_val );
-		ret = frontendDB->be_dfltaccess >= access;
+			frontendDB->be_dfltaccess >= access_level ?
+				"granted" : "denied", op->o_dn.bv_val );
+		ret = frontendDB->be_dfltaccess >= access_level;
 
 		if ( maskp ) {
 			int	i;
@@ -319,12 +664,12 @@ access_allowed_mask(
 	ret = 0;
 	control = ACL_BREAK;
 
-	if( st_same_attr ) {
+	if ( st_same_attr ) {
 		assert( state->as_vd_acl != NULL );
 
 		a = state->as_vd_acl;
 		count = state->as_vd_acl_count;
-		if ( !ACL_IS_INVALID( state->as_vd_acl_mask )) {
+		if ( !ACL_IS_INVALID( state->as_vd_acl_mask ) ) {
 			mask = state->as_vd_acl_mask;
 			AC_MEMCPY( matches, state->as_vd_acl_matches, sizeof(matches) );
 			goto vd_access;
@@ -335,45 +680,51 @@ access_allowed_mask(
 		a = NULL;
 		ACL_INIT(mask);
 		count = 0;
-		memset(matches, '\0', sizeof(matches));
+		memset( matches, '\0', sizeof(matches) );
 	}
 
-	while((a = acl_get( a, &count, op, e, desc, val,
-		MAXREMATCHES, matches, state )) != NULL)
+	while ( ( a = slap_acl_get( a, &count, op, e, desc, val,
+		MAXREMATCHES, matches, state ) ) != NULL )
 	{
 		int i;
 
-		for (i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++) {
+		for ( i = 0; i < MAXREMATCHES && matches[i].rm_so > 0; i++ ) {
 			Debug( LDAP_DEBUG_ACL, "=> match[%d]: %d %d ", i,
-			    (int)matches[i].rm_so, (int)matches[i].rm_eo );
-			if( matches[i].rm_so <= matches[0].rm_eo ) {
+				(int)matches[i].rm_so, (int)matches[i].rm_eo );
+			if ( matches[i].rm_so <= matches[0].rm_eo ) {
 				int n;
-				for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++) {
+				for ( n = matches[i].rm_so; n < matches[i].rm_eo; n++ ) {
 					Debug( LDAP_DEBUG_ACL, "%c", e->e_ndn[n], 0, 0 );
 				}
 			}
 			Debug( LDAP_DEBUG_ARGS, "\n", 0, 0, 0 );
 		}
 
-		if (state) {
-			if (state->as_vi_acl == a && (state->as_recorded & ACL_STATE_RECORDED_NV)) {
-				Debug( LDAP_DEBUG_ACL, "access_allowed: result from state (%s)\n", attr, 0, 0 );
+		if ( state ) {
+			if ( state->as_vi_acl == a &&
+				( state->as_recorded & ACL_STATE_RECORDED_NV ) )
+			{
+				Debug( LDAP_DEBUG_ACL,
+					"access_allowed: result from state (%s)\n",
+					attr, 0, 0 );
 				ret = state->as_result;
 				goto done;
 			} else {
-				Debug( LDAP_DEBUG_ACL, "access_allowed: no res from state (%s)\n", attr, 0, 0);
+				Debug( LDAP_DEBUG_ACL,
+					"access_allowed: no res from state (%s)\n",
+					attr, 0, 0 );
 			}
 		}
 
 vd_access:
-		control = acl_mask( a, &mask, op,
+		control = slap_acl_mask( a, &mask, op,
 			e, desc, val, MAXREMATCHES, matches, count, state );
 
 		if ( control != ACL_BREAK ) {
 			break;
 		}
 
-		memset(matches, '\0', sizeof(matches));
+		memset( matches, '\0', sizeof(matches) );
 	}
 
 	if ( ACL_IS_INVALID( mask ) ) {
@@ -384,7 +735,7 @@ vd_access:
 
 	} else if ( control == ACL_BREAK ) {
 		Debug( LDAP_DEBUG_ACL,
-			"=> access_allowed: no more rules\n", 0, 0, 0);
+			"=> access_allowed: no more rules\n", 0, 0, 0 );
 
 		goto done;
 	}
@@ -393,33 +744,34 @@ vd_access:
 		"=> access_allowed: %s access %s by %s\n",
 		access2str( access ),
 		ACL_GRANT(mask, access) ? "granted" : "denied",
-		accessmask2str( mask, accessmaskbuf ) );
+		accessmask2str( mask, accessmaskbuf, 1 ) );
 
 	ret = ACL_GRANT(mask, access);
 
 done:
-	if( state != NULL ) {
+	if ( state != NULL ) {
 		/* If not value-dependent, save ACL in case of more attrs */
-		if ( !(state->as_recorded & ACL_STATE_RECORDED_VD) ) {
+		if ( !( state->as_recorded & ACL_STATE_RECORDED_VD ) ) {
 			state->as_vi_acl = a;
 			state->as_result = ret;
 		}
 		state->as_recorded |= ACL_STATE_RECORDED;
 	}
-	if (be_null) op->o_bd = NULL;
+	if ( be_null ) op->o_bd = NULL;
 	if ( maskp ) *maskp = mask;
 	return ret;
 }
 
+#endif /* SLAP_OVERLAY_ACCESS */
 
 /*
- * acl_get - return the acl applicable to entry e, attribute
+ * slap_acl_get - return the acl applicable to entry e, attribute
  * attr.  the acl returned is suitable for use in subsequent calls to
  * acl_access_allowed().
  */
 
 static AccessControl *
-acl_get(
+slap_acl_get(
 	AccessControl *a,
 	int			*count,
 	Operation	*op,
@@ -529,7 +881,7 @@ acl_get(
 
 			if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) {
 				state->as_recorded |= ACL_STATE_RECORDED_VD;
-				state->as_vd_acl = prev;
+				state->as_vd_acl = a;
 				state->as_vd_acl_count = *count;
 				state->as_vd_access = a->acl_access;
 				state->as_vd_access_count = 1;
@@ -540,8 +892,11 @@ acl_get(
 				Debug( LDAP_DEBUG_ACL,
 					"acl_get: valpat %s\n",
 					a->acl_attrval.bv_val, 0, 0 );
-				if (regexec(&a->acl_attrval_re, val->bv_val, 0, NULL, 0))
+				if ( regexec( &a->acl_attrval_re, val->bv_val, 0, NULL, 0 ) )
+				{
 					continue;
+				}
+
 			} else {
 				int match = 0;
 				const char *text;
@@ -565,11 +920,11 @@ acl_get(
 					if ( vdnlen < patlen )
 						continue;
 	
-					if ( a->acl_dn_style == ACL_STYLE_BASE ) {
+					if ( a->acl_attrval_style == ACL_STYLE_BASE ) {
 						if ( vdnlen > patlen )
 							continue;
 	
-					} else if ( a->acl_dn_style == ACL_STYLE_ONE ) {
+					} else if ( a->acl_attrval_style == ACL_STYLE_ONE ) {
 						int rdnlen = -1;
 	
 						if ( !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
@@ -579,11 +934,11 @@ acl_get(
 						if ( rdnlen != vdnlen - patlen - 1 )
 							continue;
 	
-					} else if ( a->acl_dn_style == ACL_STYLE_SUBTREE ) {
+					} else if ( a->acl_attrval_style == ACL_STYLE_SUBTREE ) {
 						if ( vdnlen > patlen && !DN_SEPARATOR( val->bv_val[vdnlen - patlen - 1] ) )
 							continue;
 	
-					} else if ( a->acl_dn_style == ACL_STYLE_CHILDREN ) {
+					} else if ( a->acl_attrval_style == ACL_STYLE_CHILDREN ) {
 						if ( vdnlen <= patlen )
 							continue;
 	
@@ -604,32 +959,401 @@ acl_get(
 			}
 		}
 
-		Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] attr %s\n",
-		       *count, attr, 0);
-		return a;
+		Debug( LDAP_DEBUG_ACL, "=> acl_get: [%d] attr %s\n",
+		       *count, attr, 0);
+		return a;
+	}
+
+	Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
+	return( NULL );
+}
+
+static int
+acl_mask_dn(
+	Operation		*op,
+	Entry			*e,
+	AccessControl		*a,
+	int			nmatch,
+	regmatch_t		*matches,
+	slap_dn_access		*b,
+	struct berval		*opndn )
+{
+	/*
+	 * if access applies to the entry itself, and the
+	 * user is bound as somebody in the same namespace as
+	 * the entry, OR the given dn matches the dn pattern
+	 */
+	/*
+	 * NOTE: styles "anonymous", "users" and "self" 
+	 * have been moved to enum slap_style_t, whose 
+	 * value is set in a_dn_style; however, the string
+	 * is maintaned in a_dn_pat.
+	 */
+	if ( b->a_style == ACL_STYLE_ANONYMOUS ) {
+		if ( !BER_BVISEMPTY( opndn ) ) {
+			return 1;
+		}
+
+	} else if ( b->a_style == ACL_STYLE_USERS ) {
+		if ( BER_BVISEMPTY( opndn ) ) {
+			return 1;
+		}
+
+	} else if ( b->a_style == ACL_STYLE_SELF ) {
+		struct berval	ndn, selfndn;
+		int		level;
+
+		if ( BER_BVISEMPTY( opndn ) || BER_BVISNULL( &e->e_nname ) ) {
+			return 1;
+		}
+
+		level = b->a_self_level;
+		if ( level < 0 ) {
+			selfndn = *opndn;
+			ndn = e->e_nname;
+			level = -level;
+
+		} else {
+			ndn = *opndn;
+			selfndn = e->e_nname;
+		}
+
+		for ( ; level > 0; level-- ) {
+			if ( BER_BVISEMPTY( &ndn ) ) {
+				break;
+			}
+			dnParent( &ndn, &ndn );
+		}
+			
+		if ( BER_BVISEMPTY( &ndn ) || !dn_match( &ndn, &selfndn ) )
+		{
+			return 1;
+		}
+
+	} else if ( b->a_style == ACL_STYLE_REGEX ) {
+		if ( !ber_bvccmp( &b->a_pat, '*' ) ) {
+			int		tmp_nmatch;
+			regmatch_t	tmp_matches[2],
+					*tmp_matchesp = tmp_matches;
+
+			int		rc = 0;
+
+			switch ( a->acl_dn_style ) {
+			case ACL_STYLE_REGEX:
+				if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
+					tmp_matchesp = matches;
+					tmp_nmatch = nmatch;
+					break;
+				}
+			/* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
+
+			case ACL_STYLE_BASE:
+				tmp_matches[0].rm_so = 0;
+				tmp_matches[0].rm_eo = e->e_nname.bv_len;
+				tmp_nmatch = 1;
+				break;
+
+			case ACL_STYLE_ONE:
+			case ACL_STYLE_SUBTREE:
+			case ACL_STYLE_CHILDREN:
+				tmp_matches[0].rm_so = 0;
+				tmp_matches[0].rm_eo = e->e_nname.bv_len;
+				tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
+				tmp_matches[1].rm_eo = e->e_nname.bv_len;
+				tmp_nmatch = 2;
+				break;
+
+			default:
+				/* error */
+				rc = 1;
+				break;
+			}
+
+			if ( rc ) {
+				return 1;
+			}
+
+			if ( !regex_matches( &b->a_pat, opndn->bv_val,
+				e->e_ndn, tmp_nmatch, tmp_matchesp ) )
+			{
+				return 1;
+			}
+		}
+
+	} else {
+		struct berval	pat;
+		ber_len_t	patlen, odnlen;
+		int		got_match = 0;
+
+		if ( e->e_dn == NULL )
+			return 1;
+
+		if ( b->a_expand ) {
+			struct berval	bv;
+			char		buf[ACL_BUF_SIZE];
+			
+			int		tmp_nmatch;
+			regmatch_t	tmp_matches[2],
+					*tmp_matchesp = tmp_matches;
+
+			int		rc = 0;
+
+			bv.bv_len = sizeof( buf ) - 1;
+			bv.bv_val = buf;
+
+			switch ( a->acl_dn_style ) {
+			case ACL_STYLE_REGEX:
+				if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
+					tmp_matchesp = matches;
+					tmp_nmatch = nmatch;
+					break;
+				}
+			/* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
+
+			case ACL_STYLE_BASE:
+				tmp_matches[0].rm_so = 0;
+				tmp_matches[0].rm_eo = e->e_nname.bv_len;
+				tmp_nmatch = 1;
+				break;
+
+			case ACL_STYLE_ONE:
+			case ACL_STYLE_SUBTREE:
+			case ACL_STYLE_CHILDREN:
+				tmp_matches[0].rm_so = 0;
+				tmp_matches[0].rm_eo = e->e_nname.bv_len;
+				tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
+				tmp_matches[1].rm_eo = e->e_nname.bv_len;
+				tmp_nmatch = 2;
+				break;
+
+			default:
+				/* error */
+				rc = 1;
+				break;
+			}
+
+			if ( rc ) {
+				return 1;
+			}
+
+			if ( string_expand( &bv, &b->a_pat, 
+					e->e_nname.bv_val,
+					tmp_nmatch, tmp_matchesp ) )
+			{
+				return 1;
+			}
+			
+			if ( dnNormalize(0, NULL, NULL, &bv,
+					&pat, op->o_tmpmemctx )
+					!= LDAP_SUCCESS )
+			{
+				/* did not expand to a valid dn */
+				return 1;
+			}
+
+		} else {
+			pat = b->a_pat;
+		}
+
+		patlen = pat.bv_len;
+		odnlen = opndn->bv_len;
+		if ( odnlen < patlen ) {
+			goto dn_match_cleanup;
+
+		}
+
+		if ( b->a_style == ACL_STYLE_BASE ) {
+			/* base dn -- entire object DN must match */
+			if ( odnlen != patlen ) {
+				goto dn_match_cleanup;
+			}
+
+		} else if ( b->a_style == ACL_STYLE_ONE ) {
+			int rdnlen = -1;
+
+			if ( odnlen <= patlen ) {
+				goto dn_match_cleanup;
+			}
+
+			if ( !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
+				goto dn_match_cleanup;
+			}
+
+			rdnlen = dn_rdnlen( NULL, opndn );
+			if ( rdnlen != odnlen - patlen - 1 ) {
+				goto dn_match_cleanup;
+			}
+
+		} else if ( b->a_style == ACL_STYLE_SUBTREE ) {
+			if ( odnlen > patlen && !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
+				goto dn_match_cleanup;
+			}
+
+		} else if ( b->a_style == ACL_STYLE_CHILDREN ) {
+			if ( odnlen <= patlen ) {
+				goto dn_match_cleanup;
+			}
+
+			if ( !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) ) {
+				goto dn_match_cleanup;
+			}
+
+		} else if ( b->a_style == ACL_STYLE_LEVEL ) {
+			int level;
+			struct berval ndn;
+
+			if ( odnlen <= patlen ) {
+				goto dn_match_cleanup;
+			}
+
+			if ( level > 0 && !DN_SEPARATOR( opndn->bv_val[odnlen - patlen - 1] ) )
+			{
+				goto dn_match_cleanup;
+			}
+			
+			level = b->a_level;
+			ndn = *opndn;
+			for ( ; level > 0; level-- ) {
+				if ( BER_BVISEMPTY( &ndn ) ) {
+					goto dn_match_cleanup;
+				}
+				dnParent( &ndn, &ndn );
+				if ( ndn.bv_len < patlen ) {
+					goto dn_match_cleanup;
+				}
+			}
+			
+			if ( ndn.bv_len != patlen ) {
+				goto dn_match_cleanup;
+			}
+		}
+
+		got_match = !strcmp( pat.bv_val, &opndn->bv_val[ odnlen - patlen ] );
+
+dn_match_cleanup:;
+		if ( pat.bv_val != b->a_pat.bv_val ) {
+			slap_sl_free( pat.bv_val, op->o_tmpmemctx );
+		}
+
+		if ( !got_match ) {
+			return 1;
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * Record value-dependent access control state
+ */
+#define ACL_RECORD_VALUE_STATE do { \
+		if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) { \
+			state->as_recorded |= ACL_STATE_RECORDED_VD; \
+			state->as_vd_acl = a; \
+			AC_MEMCPY( state->as_vd_acl_matches, matches, \
+				sizeof( state->as_vd_acl_matches )) ; \
+			state->as_vd_acl_count = count; \
+			state->as_vd_access = b; \
+			state->as_vd_access_count = i; \
+		} \
+	} while( 0 )
+
+static int
+acl_mask_dnattr(
+	Operation		*op,
+	Entry			*e,
+	struct berval		*val,
+	AccessControl		*a,
+	Access			*b,
+	int			i,
+	regmatch_t		*matches,
+	int			count,
+	AccessControlState	*state,
+	slap_dn_access		*bdn,
+	struct berval		*opndn )
+{
+	Attribute	*at;
+	struct berval	bv;
+	int		rc, match = 0;
+	const char	*text;
+	const char	*attr = bdn->a_at->ad_cname.bv_val;
+
+	assert( attr != NULL );
+
+	if ( BER_BVISEMPTY( opndn ) ) {
+		return 1;
+	}
+
+	Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n", attr, 0, 0 );
+	bv = *opndn;
+
+	/* see if asker is listed in dnattr */
+	for ( at = attrs_find( e->e_attrs, bdn->a_at );
+		at != NULL;
+		at = attrs_find( at->a_next, bdn->a_at ) )
+	{
+		if ( value_find_ex( bdn->a_at,
+			SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
+				SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
+			at->a_nvals,
+			&bv, op->o_tmpmemctx ) == 0 )
+		{
+			/* found it */
+			match = 1;
+			break;
+		}
+	}
+
+	if ( match ) {
+		/* have a dnattr match. if this is a self clause then
+		 * the target must also match the op dn.
+		 */
+		if ( bdn->a_self ) {
+			/* check if the target is an attribute. */
+			if ( val == NULL ) return 1;
+
+			/* target is attribute, check if the attribute value
+			 * is the op dn.
+			 */
+			rc = value_match( &match, bdn->a_at,
+				bdn->a_at->ad_type->sat_equality, 0,
+				val, &bv, &text );
+			/* on match error or no match, fail the ACL clause */
+			if ( rc != LDAP_SUCCESS || match != 0 )
+				return 1;
+		}
+
+	} else {
+		/* no dnattr match, check if this is a self clause */
+		if ( ! bdn->a_self )
+			return 1;
+
+		ACL_RECORD_VALUE_STATE;
+		
+		/* this is a self clause, check if the target is an
+		 * attribute.
+		 */
+		if ( val == NULL )
+			return 1;
+
+		/* target is attribute, check if the attribute value
+		 * is the op dn.
+		 */
+		rc = value_match( &match, bdn->a_at,
+			bdn->a_at->ad_type->sat_equality, 0,
+			val, &bv, &text );
+
+		/* on match error or no match, fail the ACL clause */
+		if ( rc != LDAP_SUCCESS || match != 0 )
+			return 1;
 	}
 
-	Debug( LDAP_DEBUG_ACL, "<= acl_get: done.\n", 0, 0, 0 );
-	return( NULL );
+	return 0;
 }
 
-/*
- * Record value-dependent access control state
- */
-#define ACL_RECORD_VALUE_STATE do { \
-		if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) { \
-			state->as_recorded |= ACL_STATE_RECORDED_VD; \
-			state->as_vd_acl = a; \
-			AC_MEMCPY( state->as_vd_acl_matches, matches, \
-				sizeof( state->as_vd_acl_matches )) ; \
-			state->as_vd_acl_count = count; \
-			state->as_vd_access = b; \
-			state->as_vd_access_count = i; \
-		} \
-	} while( 0 )
 
 /*
- * acl_mask - modifies mask based upon the given acl and the
+ * slap_acl_mask - modifies mask based upon the given acl and the
  * requested access to entry e, attribute attr, value val.  if val
  * is null, access to the whole attribute is assumed (all values).
  *
@@ -638,7 +1362,7 @@ acl_get(
  */
 
 static slap_control_t
-acl_mask(
+slap_acl_mask(
 	AccessControl		*a,
 	slap_mask_t		*mask,
 	Operation		*op,
@@ -650,12 +1374,14 @@ acl_mask(
 	int			count,
 	AccessControlState	*state )
 {
-	int		i, odnlen, patlen;
+	int		i;
 	Access	*b;
 #ifdef LDAP_DEBUG
 	char accessmaskbuf[ACCESSMASK_MAXLEN];
+#if !defined( SLAP_DYNACL ) && defined( SLAPD_ACI_ENABLED )
 	char accessmaskbuf1[ACCESSMASK_MAXLEN];
-#endif
+#endif /* !SLAP_DYNACL && SLAPD_ACI_ENABLED */
+#endif /* DEBUG */
 	const char *attr;
 
 	assert( a != NULL );
@@ -674,7 +1400,7 @@ acl_mask(
 		"=> acl_mask: to %s by \"%s\", (%s) \n",
 		val ? "value" : "all values",
 		op->o_ndn.bv_val ?  op->o_ndn.bv_val : "",
-		accessmask2str( *mask, accessmaskbuf ) );
+		accessmask2str( *mask, accessmaskbuf, 1 ) );
 
 
 	if( state && ( state->as_recorded & ACL_STATE_RECORDED_VD )
@@ -704,208 +1430,46 @@ acl_mask(
 			 */
 			/*
 			 * NOTE: styles "anonymous", "users" and "self" 
-			 * have been moved to an enumeration, * whose value
-			 * is set in a_dn_style; however, the string
+			 * have been moved to enum slap_style_t, whose 
+			 * value is set in a_dn_style; however, the string
 			 * is maintaned in a_dn_pat.
 			 */
-			if ( b->a_dn_style == ACL_STYLE_ANONYMOUS /* bvmatch( &b->a_dn_pat, &aci_bv_anonymous ) */ ) {
-				if ( op->o_ndn.bv_len != 0 ) {
-					continue;
-				}
-
-			} else if ( b->a_dn_style == ACL_STYLE_USERS /* bvmatch( &b->a_dn_pat, &aci_bv_users ) */ ) {
-				if ( op->o_ndn.bv_len == 0 ) {
-					continue;
-				}
-
-			} else if ( b->a_dn_style == ACL_STYLE_SELF /* bvmatch( &b->a_dn_pat, &aci_bv_self ) */ ) {
-				if ( op->o_ndn.bv_len == 0 ) {
-					continue;
-				}
-				
-				if ( e->e_dn == NULL || !dn_match( &e->e_nname, &op->o_ndn ) ) {
-					continue;
-				}
-
-			} else if ( b->a_dn_style == ACL_STYLE_REGEX ) {
-				if ( !ber_bvccmp( &b->a_dn_pat, '*' ) ) {
-					int		tmp_nmatch;
-					regmatch_t	tmp_matches[2],
-							*tmp_matchesp = tmp_matches;
-
-					int		rc = 0;
-
-					switch ( a->acl_dn_style ) {
-					case ACL_STYLE_REGEX:
-						if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
-							tmp_matchesp = matches;
-							tmp_nmatch = nmatch;
-							break;
-						}
-					/* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
-
-					case ACL_STYLE_BASE:
-						tmp_matches[0].rm_so = 0;
-						tmp_matches[0].rm_eo = e->e_nname.bv_len;
-						tmp_nmatch = 1;
-						break;
-
-					case ACL_STYLE_ONE:
-					case ACL_STYLE_SUBTREE:
-					case ACL_STYLE_CHILDREN:
-						tmp_matches[0].rm_so = 0;
-						tmp_matches[0].rm_eo = e->e_nname.bv_len;
-						tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
-						tmp_matches[1].rm_eo = e->e_nname.bv_len;
-						tmp_nmatch = 2;
-						break;
 
-					default:
-						/* error */
-						rc = 1;
-						break;
-					}
+			if ( acl_mask_dn( op, e, a, nmatch, matches,
+				&b->a_dn, &op->o_ndn ) )
+			{
+				continue;
+			}
+		}
 
-					if ( rc ) {
-						continue;
-					}
+		if ( !BER_BVISEMPTY( &b->a_realdn_pat ) ) {
+			struct berval	ndn;
 
-					if ( !regex_matches( &b->a_dn_pat,
-						op->o_ndn.bv_val, e->e_ndn,
-						tmp_nmatch, tmp_matchesp ) )
-					{
-						continue;
-					}
-				}
+			Debug( LDAP_DEBUG_ACL, "<= check a_realdn_pat: %s\n",
+				b->a_realdn_pat.bv_val, 0, 0);
+			/*
+			 * if access applies to the entry itself, and the
+			 * user is bound as somebody in the same namespace as
+			 * the entry, OR the given dn matches the dn pattern
+			 */
+			/*
+			 * NOTE: styles "anonymous", "users" and "self" 
+			 * have been moved to enum slap_style_t, whose 
+			 * value is set in a_dn_style; however, the string
+			 * is maintaned in a_dn_pat.
+			 */
 
+			if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) )
+			{
+				ndn = op->o_conn->c_ndn;
 			} else {
-				struct berval pat;
-				int got_match = 0;
-
-				if ( e->e_dn == NULL )
-					continue;
-
-				if ( b->a_dn_expand ) {
-					struct berval	bv;
-					char		buf[ACL_BUF_SIZE];
-					
-					int		tmp_nmatch;
-					regmatch_t	tmp_matches[2],
-							*tmp_matchesp = tmp_matches;
-
-					int		rc = 0;
-
-					bv.bv_len = sizeof( buf ) - 1;
-					bv.bv_val = buf;
-
-					switch ( a->acl_dn_style ) {
-					case ACL_STYLE_REGEX:
-						if ( !BER_BVISNULL( &a->acl_dn_pat ) ) {
-							tmp_matchesp = matches;
-							tmp_nmatch = nmatch;
-							break;
-						}
-					/* FALLTHRU: applies also to ACL_STYLE_REGEX when pattern is "*" */
-
-					case ACL_STYLE_BASE:
-						tmp_matches[0].rm_so = 0;
-						tmp_matches[0].rm_eo = e->e_nname.bv_len;
-						tmp_nmatch = 1;
-						break;
-
-					case ACL_STYLE_ONE:
-					case ACL_STYLE_SUBTREE:
-					case ACL_STYLE_CHILDREN:
-						tmp_matches[0].rm_so = 0;
-						tmp_matches[0].rm_eo = e->e_nname.bv_len;
-						tmp_matches[1].rm_so = e->e_nname.bv_len - a->acl_dn_pat.bv_len;
-						tmp_matches[1].rm_eo = e->e_nname.bv_len;
-						tmp_nmatch = 2;
-						break;
-
-					default:
-						/* error */
-						rc = 1;
-						break;
-					}
-
-					if ( rc ) {
-						continue;
-					}
-
-					if ( string_expand( &bv, &b->a_dn_pat, 
-							e->e_nname.bv_val,
-							tmp_nmatch, tmp_matchesp ) )
-					{
-						continue;
-					}
-					
-					if ( dnNormalize(0, NULL, NULL, &bv,
-							&pat, op->o_tmpmemctx )
-							!= LDAP_SUCCESS )
-					{
-						/* did not expand to a valid dn */
-						continue;
-					}
-
-				} else {
-					pat = b->a_dn_pat;
-				}
-
-				patlen = pat.bv_len;
-				odnlen = op->o_ndn.bv_len;
-				if ( odnlen < patlen ) {
-					goto dn_match_cleanup;
-
-				}
-
-				if ( b->a_dn_style == ACL_STYLE_BASE ) {
-					/* base dn -- entire object DN must match */
-					if ( odnlen != patlen ) {
-						goto dn_match_cleanup;
-					}
-
-				} else if ( b->a_dn_style == ACL_STYLE_ONE ) {
-					int rdnlen = -1;
-
-					if ( odnlen <= patlen ) {
-						goto dn_match_cleanup;
-					}
-
-					if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) ) {
-						goto dn_match_cleanup;
-					}
-
-					rdnlen = dn_rdnlen( NULL, &op->o_ndn );
-					if ( rdnlen != odnlen - patlen - 1 ) {
-						goto dn_match_cleanup;
-					}
-
-				} else if ( b->a_dn_style == ACL_STYLE_SUBTREE ) {
-					if ( odnlen > patlen && !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) ) {
-						goto dn_match_cleanup;
-					}
-
-				} else if ( b->a_dn_style == ACL_STYLE_CHILDREN ) {
-					if ( odnlen <= patlen ) {
-						goto dn_match_cleanup;
-					}
-
-					if ( !DN_SEPARATOR( op->o_ndn.bv_val[odnlen - patlen - 1] ) ) {
-						goto dn_match_cleanup;
-					}
-				}
-
-				got_match = !strcmp( pat.bv_val, op->o_ndn.bv_val + odnlen - patlen );
-
-dn_match_cleanup:;
-				if ( pat.bv_val != b->a_dn_pat.bv_val ) {
-					slap_sl_free( pat.bv_val, op->o_tmpmemctx );
-				}
+				ndn = op->o_ndn;
+			}
 
-				if ( !got_match ) {
-					continue;
-				}
+			if ( acl_mask_dn( op, e, a, nmatch, matches,
+				&b->a_realdn, &ndn ) )
+			{
+				continue;
 			}
 		}
 
@@ -1152,80 +1716,29 @@ dn_match_cleanup:;
 		}
 
 		if ( b->a_dn_at != NULL ) {
-			Attribute	*at;
-			struct berval	bv;
-			int rc, match = 0;
-			const char *text;
-			const char *attr = b->a_dn_at->ad_cname.bv_val;
-
-			assert( attr != NULL );
-
-			if ( op->o_ndn.bv_len == 0 ) {
+			if ( acl_mask_dnattr( op, e, val, a, b, i,
+					matches, count, state,
+					&b->a_dn, &op->o_ndn ) )
+			{
 				continue;
 			}
+		}
 
-			Debug( LDAP_DEBUG_ACL, "<= check a_dn_at: %s\n",
-				attr, 0, 0);
-			bv = op->o_ndn;
+		if ( b->a_realdn_at != NULL ) {
+			struct berval	ndn;
 
-			/* see if asker is listed in dnattr */
-			for( at = attrs_find( e->e_attrs, b->a_dn_at );
-				at != NULL;
-				at = attrs_find( at->a_next, b->a_dn_at ) )
+			if ( op->o_conn && !BER_BVISNULL( &op->o_conn->c_ndn ) )
 			{
-				if( value_find_ex( b->a_dn_at,
-					SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
-						SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
-					at->a_nvals,
-					&bv, op->o_tmpmemctx ) == 0 )
-				{
-					/* found it */
-					match = 1;
-					break;
-				}
-			}
-
-			if( match ) {
-				/* have a dnattr match. if this is a self clause then
-				 * the target must also match the op dn.
-				 */
-				if ( b->a_dn_self ) {
-					/* check if the target is an attribute. */
-					if ( val == NULL ) continue;
-
-					/* target is attribute, check if the attribute value
-					 * is the op dn.
-					 */
-					rc = value_match( &match, b->a_dn_at,
-						b->a_dn_at->ad_type->sat_equality, 0,
-						val, &bv, &text );
-					/* on match error or no match, fail the ACL clause */
-					if (rc != LDAP_SUCCESS || match != 0 )
-						continue;
-				}
+				ndn = op->o_conn->c_ndn;
 			} else {
-				/* no dnattr match, check if this is a self clause */
-				if ( ! b->a_dn_self )
-					continue;
-
-				ACL_RECORD_VALUE_STATE;
-				
-				/* this is a self clause, check if the target is an
-				 * attribute.
-				 */
-				if ( val == NULL )
-					continue;
-
-				/* target is attribute, check if the attribute value
-				 * is the op dn.
-				 */
-				rc = value_match( &match, b->a_dn_at,
-					b->a_dn_at->ad_type->sat_equality, 0,
-					val, &bv, &text );
+				ndn = op->o_ndn;
+			}
 
-				/* on match error or no match, fail the ACL clause */
-				if (rc != LDAP_SUCCESS || match != 0 )
-					continue;
+			if ( acl_mask_dnattr( op, e, val, a, b, i,
+					matches, count, state,
+					&b->a_realdn, &ndn ) )
+			{
+				continue;
 			}
 		}
 
@@ -1465,7 +1978,7 @@ dn_match_cleanup:;
 				continue;
 			}
 
-			/* this could be improved by changing acl_mask so that it can deal with
+			/* this could be improved by changing slap_acl_mask so that it can deal with
 			 * by clauses that return grant/deny pairs.  Right now, it does either
 			 * additive or subtractive rights, but not both at the same time.  So,
 			 * we need to combine the grant/deny pair into a single rights mask in
@@ -1490,8 +2003,7 @@ dn_match_cleanup:;
 		if ( b->a_aci_at != NULL ) {
 			Attribute	*at;
 			slap_access_t	grant, deny, tgrant, tdeny;
-			struct berval	parent_ndn,
-					old_parent_ndn = BER_BVNULL;
+			struct berval	parent_ndn;
 			BerVarray	bvals = NULL;
 			int		ret, stop;
 
@@ -1539,8 +2051,8 @@ dn_match_cleanup:;
 					}
 				}
 				Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
-					  accessmask2str(tgrant,accessmaskbuf), 
-					  accessmask2str(tdeny, accessmaskbuf1), 0);
+					  accessmask2str(tgrant, accessmaskbuf, 1), 
+					  accessmask2str(tdeny, accessmaskbuf1, 1), 0);
 
 			}
 			/* If the entry level aci didn't contain anything valid for the 
@@ -1548,9 +2060,8 @@ dn_match_cleanup:;
 			 * acis with scope set to subtree
 			 */
 			if ( (tgrant == ACL_PRIV_NONE) && (tdeny == ACL_PRIV_NONE) ) {
-				dnParent(&(e->e_nname), &parent_ndn);
-				while ( parent_ndn.bv_val != old_parent_ndn.bv_val ) {
-					old_parent_ndn = parent_ndn;
+				dnParent( &e->e_nname, &parent_ndn );
+				while ( !BER_BVISEMPTY( &parent_ndn ) ) {
 					Debug(LDAP_DEBUG_ACL, "checking ACI of %s\n", parent_ndn.bv_val, 0, 0);
 					ret = backend_attribute(op, NULL, &parent_ndn, b->a_aci_at, &bvals, ACL_AUTH);
 					switch(ret){
@@ -1580,8 +2091,8 @@ dn_match_cleanup:;
 								}
 							}
 							Debug(LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n", 
-								accessmask2str(tgrant,accessmaskbuf),
-								accessmask2str(tdeny, accessmaskbuf1), 0);
+								accessmask2str(tgrant, accessmaskbuf, 1),
+								accessmask2str(tdeny, accessmaskbuf1, 1), 0);
 						}
 						break;
 
@@ -1606,7 +2117,7 @@ dn_match_cleanup:;
 					if (stop){
 						break;
 					}
-					dnParent(&old_parent_ndn, &parent_ndn);
+					dnParent( &parent_ndn, &parent_ndn );
 				}
 			}
 
@@ -1620,7 +2131,7 @@ dn_match_cleanup:;
 				continue;
 			}
 
-			/* this could be improved by changing acl_mask so that it can deal with
+			/* this could be improved by changing slap_acl_mask so that it can deal with
 			 * by clauses that return grant/deny pairs.  Right now, it does either
 			 * additive or subtractive rights, but not both at the same time.  So,
 			 * we need to combine the grant/deny pair into a single rights mask in
@@ -1647,7 +2158,7 @@ dn_match_cleanup:;
 
 		Debug( LDAP_DEBUG_ACL,
 			"<= acl_mask: [%d] applying %s (%s)\n",
-			i, accessmask2str( modmask, accessmaskbuf ), 
+			i, accessmask2str( modmask, accessmaskbuf, 1 ), 
 			b->a_type == ACL_CONTINUE
 				? "continue"
 				: b->a_type == ACL_BREAK
@@ -1677,7 +2188,7 @@ dn_match_cleanup:;
 
 		Debug( LDAP_DEBUG_ACL,
 			"<= acl_mask: [%d] mask: %s\n",
-			i, accessmask2str(*mask, accessmaskbuf), 0 );
+			i, accessmask2str(*mask, accessmaskbuf, 1), 0 );
 
 		if( b->a_type == ACL_CONTINUE ) {
 			continue;
@@ -1695,7 +2206,7 @@ dn_match_cleanup:;
 
 	Debug( LDAP_DEBUG_ACL,
 		"<= acl_mask: no more <who> clauses, returning %s (stop)\n",
-		accessmask2str(*mask, accessmaskbuf), 0, 0 );
+		accessmask2str(*mask, accessmaskbuf, 1), 0, 0 );
 	return ACL_STOP;
 }
 
@@ -1721,7 +2232,7 @@ acl_check_modlist(
 
 	be = op->o_bd;
 	if ( be == NULL ) {
-		be = &backends[0];
+		be = LDAP_STAILQ_FIRST(&backendDB);
 		be_null = 1;
 		op->o_bd = be;
 	}
@@ -1740,12 +2251,24 @@ acl_check_modlist(
 		Debug( LDAP_DEBUG_ACL,
 			"=> access_allowed: backend default %s access %s to \"%s\"\n",
 			access2str( ACL_WRITE ),
-			op->o_bd->be_dfltaccess >= ACL_WRITE ? "granted" : "denied", op->o_dn.bv_val );
+			op->o_bd->be_dfltaccess >= ACL_WRITE
+				? "granted" : "denied",
+			op->o_dn.bv_val );
 		ret = (op->o_bd->be_dfltaccess >= ACL_WRITE);
 		goto done;
 	}
 
 	for ( ; mlist != NULL; mlist = mlist->sml_next ) {
+		/*
+		 * Internal mods are ignored by ACL_WRITE checking
+		 */
+		if ( mlist->sml_flags & SLAP_MOD_INTERNAL ) {
+			Debug( LDAP_DEBUG_ACL, "acl: internal mod %s:"
+				" modify access granted\n",
+				mlist->sml_desc->ad_cname.bv_val, 0, 0 );
+			continue;
+		}
+
 		/*
 		 * no-user-modification operational attributes are ignored
 		 * by ACL_WRITE checking as any found here are not provided
@@ -1766,7 +2289,7 @@ acl_check_modlist(
 			 * This prevents abuse from selfwriters.
 			 */
 			if ( ! access_allowed( op, e,
-				mlist->sml_desc, NULL, ACL_WRITE, &state ) )
+				mlist->sml_desc, NULL, ACL_WDEL, &state ) )
 			{
 				ret = 0;
 				goto done;
@@ -1784,7 +2307,7 @@ acl_check_modlist(
 				bv->bv_val != NULL; bv++ )
 			{
 				if ( ! access_allowed( op, e,
-					mlist->sml_desc, bv, ACL_WRITE, &state ) )
+					mlist->sml_desc, bv, ACL_WADD, &state ) )
 				{
 					ret = 0;
 					goto done;
@@ -1795,7 +2318,7 @@ acl_check_modlist(
 		case LDAP_MOD_DELETE:
 			if ( mlist->sml_values == NULL ) {
 				if ( ! access_allowed( op, e,
-					mlist->sml_desc, NULL, ACL_WRITE, NULL ) )
+					mlist->sml_desc, NULL, ACL_WDEL, NULL ) )
 				{
 					ret = 0;
 					goto done;
@@ -1807,7 +2330,7 @@ acl_check_modlist(
 				bv->bv_val != NULL; bv++ )
 			{
 				if ( ! access_allowed( op, e,
-					mlist->sml_desc, bv, ACL_WRITE, &state ) )
+					mlist->sml_desc, bv, ACL_WDEL, &state ) )
 				{
 					ret = 0;
 					goto done;
@@ -2024,27 +2547,19 @@ aci_set_gather( SetCookie *cookie, struct berval *name, AttributeDescription *de
 	
 	p.cookie = cookie;
 	
+	op2.o_hdr = cp->op->o_hdr;
 	op2.o_tag = LDAP_REQ_SEARCH;
-	op2.o_protocol = LDAP_VERSION3;
 	op2.o_ndn = op2.o_bd->be_rootndn;
 	op2.o_callback = &cb;
 	op2.o_time = slap_get_time();
 	op2.o_do_not_cache = 1;
 	op2.o_is_auth_check = 0;
-	op2.o_threadctx = cp->op->o_threadctx;
-	op2.o_tmpmemctx = cp->op->o_tmpmemctx;
-	op2.o_tmpmfuncs = cp->op->o_tmpmfuncs;
-#ifdef LDAP_SLAPI
-	op2.o_pb = cp->op->o_pb;
-#endif
-	op2.o_conn = cp->op->o_conn;
-	op2.o_connid = cp->op->o_connid;
 	ber_dupbv_x( &op2.o_req_dn, &op2.o_req_ndn, cp->op->o_tmpmemctx );
 	op2.ors_slimit = SLAP_NO_LIMIT;
 	op2.ors_tlimit = SLAP_NO_LIMIT;
 	op2.ors_attrs = anlistp;
 	op2.ors_attrsonly = 0;
-	op2.o_sync_slog_size = -1;
+	op2.o_private = cp->op->o_private;
 
 	cb.sc_private = &p;
 
@@ -2119,8 +2634,9 @@ aci_match_set (
 	int		rc = 0;
 	AciSetCookie	cookie;
 
-	if (setref == 0) {
+	if ( setref == 0 ) {
 		ber_dupbv_x( &set, subj, op->o_tmpmemctx );
+
 	} else {
 		struct berval		subjdn, ndn = BER_BVNULL;
 		struct berval		setat;
@@ -2130,7 +2646,7 @@ aci_match_set (
 
 		/* format of string is "entry/setAttrName" */
 		if ( aci_get_part( subj, 0, '/', &subjdn ) < 0 ) {
-			return(0);
+			return 0;
 		}
 
 		if ( aci_get_part( subj, 1, '/', &setat ) < 0 ) {
@@ -2412,15 +2928,27 @@ aci_mask(
 	assert( !BER_BVISNULL( &desc->ad_cname ) );
 
 	/* parse an aci of the form:
-		oid#scope#action;rights;attr;rights;attr$action;rights;attr;rights;attr#dnType#subjectDN
+		oid # scope # action;rights;attr;rights;attr 
+			$ action;rights;attr;rights;attr # type # subject
+
+	   [NOTE: the following comment is very outdated,
+	   as the draft version it refers to (Ando, 2004-11-20)].
 
 	   See draft-ietf-ldapext-aci-model-04.txt section 9.1 for
 	   a full description of the format for this attribute.
 	   Differences: "this" in the draft is "self" here, and
-	   "self" and "public" is in the position of dnType.
+	   "self" and "public" is in the position of type.
 
-	   For now, this routine only supports scope=entry.
+	   <scope> = {entry|children|subtree}
+	   <type> = {public|users|access-id|subtree|onelevel|children|
+	             self|dnattr|group|role|set|set-ref}
+
+	   This routine now supports scope={ENTRY,CHILDREN}
+	   with the semantics:
+	     - ENTRY applies to "entry" and "subtree";
+	     - CHILDREN aplies to "children" and "subtree"
 	 */
+
 	/* check that the aci has all 5 components */
 	if ( aci_get_part( aci, 4, '#', NULL ) < 0 ) {
 		return 0;
@@ -2475,25 +3003,97 @@ aci_mask(
 		return 0;
 	}
 
+	/* see if we have a public (i.e. anonymous) access */
+	if ( ber_bvstrcasecmp( &aci_bv_public, &type ) == 0 ) {
+		return 1;
+	}
+	
+	/* otherwise require an identity */
+	if ( BER_BVISNULL( &op->o_ndn ) || BER_BVISEMPTY( &op->o_ndn ) ) {
+		return 0;
+	}
+
+	/* see if we have a users access */
+	if ( ber_bvstrcasecmp( &aci_bv_users, &type ) == 0 ) {
+		return 1;
+	}
+	
+	/* NOTE: this may fail if a DN contains a valid '#' (unescaped);
+	 * just grab all the berval up to its end (ITS#3303).
+	 * NOTE: the problem could be solved by providing the DN with
+	 * the embedded '#' encoded as hexpairs: "cn=Foo#Bar" would 
+	 * become "cn=Foo\23Bar" and be safely used by aci_mask(). */
+#if 0
 	if ( aci_get_part( aci, 4, '#', &sdn ) < 0 ) {
 		return 0;
 	}
+#endif
+	sdn.bv_val = type.bv_val + type.bv_len + STRLENOF( "#" );
+	sdn.bv_len = aci->bv_len - ( sdn.bv_val - aci->bv_val );
 
 	if ( ber_bvstrcasecmp( &aci_bv_access_id, &type ) == 0 ) {
 		struct berval ndn;
 		
-		rc = 0;
-		if ( dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx ) == LDAP_SUCCESS )
-		{
-			if ( dn_match( &op->o_ndn, &ndn ) ) {
-				rc = 1;
-			}
-			slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
+		rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
+		if ( rc != LDAP_SUCCESS ) {
+			return 0;
+		}
+
+		if ( dn_match( &op->o_ndn, &ndn ) ) {
+			rc = 1;
 		}
+		slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
+
 		return rc;
 
-	} else if ( ber_bvstrcasecmp( &aci_bv_public, &type ) == 0 ) {
-		return 1;
+	} else if ( ber_bvstrcasecmp( &aci_bv_subtree, &type ) == 0 ) {
+		struct berval ndn;
+		
+		rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
+		if ( rc != LDAP_SUCCESS ) {
+			return 0;
+		}
+
+		if ( dnIsSuffix( &op->o_ndn, &ndn ) ) {
+			rc = 1;
+		}
+		slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
+
+		return rc;
+
+	} else if ( ber_bvstrcasecmp( &aci_bv_onelevel, &type ) == 0 ) {
+		struct berval ndn, pndn;
+		
+		rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
+		if ( rc != LDAP_SUCCESS ) {
+			return 0;
+		}
+
+		dnParent( &ndn, &pndn );
+
+		if ( dn_match( &op->o_ndn, &pndn ) ) {
+			rc = 1;
+		}
+		slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
+
+		return rc;
+
+	} else if ( ber_bvstrcasecmp( &aci_bv_children, &type ) == 0 ) {
+		struct berval ndn;
+		
+		rc = dnNormalize( 0, NULL, NULL, &sdn, &ndn, op->o_tmpmemctx );
+		if ( rc != LDAP_SUCCESS ) {
+			return 0;
+		}
+
+		if ( !dn_match( &op->o_ndn, &ndn )
+				&& dnIsSuffix( &op->o_ndn, &ndn ) )
+		{
+			rc = 1;
+		}
+		slap_sl_free( ndn.bv_val, op->o_tmpmemctx );
+
+		return rc;
 
 	} else if ( ber_bvstrcasecmp( &aci_bv_self, &type ) == 0 ) {
 		if ( dn_match( &op->o_ndn, &e->e_nname ) ) {
@@ -2513,8 +3113,6 @@ aci_mask(
 
 		rc = 0;
 
-		bv = op->o_ndn;
-
 		for ( at = attrs_find( e->e_attrs, ad );
 				at != NULL;
 				at = attrs_find( at->a_next, ad ) )
@@ -2523,7 +3121,7 @@ aci_mask(
 				SLAP_MR_ATTRIBUTE_VALUE_NORMALIZED_MATCH |
 					SLAP_MR_ASSERTED_VALUE_NORMALIZED_MATCH,
 				at->a_nvals,
-				&bv, op->o_tmpmemctx ) == 0 )
+				&op->o_ndn, op->o_tmpmemctx ) == 0 )
 			{
 				rc = 1;
 				break;
@@ -2532,7 +3130,6 @@ aci_mask(
 
 		return rc;
 
-
 	} else if ( ber_bvstrcasecmp( &aci_bv_group, &type ) == 0 ) {
 		if ( aci_group_member( &sdn, &aci_bv_group_class,
 				&aci_bv_group_attr, op, e, nmatch, matches ) )
@@ -2561,9 +3158,12 @@ aci_mask(
 	return 0;
 }
 
-#endif	/* SLAPD_ACI_ENABLED */
-
 #ifdef SLAP_DYNACL
+/*
+ * FIXME: there is a silly dependence that makes it difficult
+ * to move ACIs in a run-time loadable module under the "dynacl" 
+ * umbrella, because sets share some helpers with ACIs.
+ */
 static int
 dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *right, void **privp )
 {
@@ -2573,7 +3173,7 @@ dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *r
 	if ( sty != ACL_STYLE_REGEX && sty != ACL_STYLE_BASE ) {
 		fprintf( stderr, "%s: line %d: "
 			"inappropriate style \"%s\" in \"aci\" by clause\n",
-			fname, lineno, sty );
+			fname, lineno, style_strings[sty] );
 		return -1;
 	}
 
@@ -2603,13 +3203,17 @@ dynacl_aci_parse( const char *fname, int lineno, slap_style_t sty, const char *r
 }
 
 static int
-dynacl_aci_print( void *priv )
+dynacl_aci_unparse( void *priv, struct berval *bv )
 {
 	AttributeDescription	*ad = ( AttributeDescription * )priv;
+	char *ptr;
 
 	assert( ad );
 
-	fprintf( stderr, " aci=%s", ad->ad_cname.bv_val );
+	bv->bv_val = ch_malloc( STRLENOF(" aci=") + ad->ad_cname.bv_len + 1 );
+	ptr = lutil_strcopy( bv->bv_val, " aci=" );
+	ptr = lutil_strcopy( ptr, ad->ad_cname.bv_val );
+	bv->bv_len = ptr - bv->bv_val;
 
 	return 0;
 }
@@ -2659,8 +3263,8 @@ dynacl_aci_mask(
 		}
 		
 		Debug( LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n",
-			  accessmask2str( tgrant, accessmaskbuf ), 
-			  accessmask2str( tdeny, accessmaskbuf1 ), 0 );
+			  accessmask2str( tgrant, accessmaskbuf, 1 ), 
+			  accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
 	}
 
 	/* If the entry level aci didn't contain anything valid for the 
@@ -2669,17 +3273,36 @@ dynacl_aci_mask(
 	 */
 	if ( tgrant == ACL_PRIV_NONE && tdeny == ACL_PRIV_NONE ) {
 		struct berval	parent_ndn;
-		struct berval	old_parent_ndn = BER_BVNULL;
+
+#if 1
+		/* to solve the chicken'n'egg problem of accessing
+		 * the OpenLDAPaci attribute, the direct access
+		 * to the entry's attribute is unchecked; however,
+		 * further accesses to OpenLDAPaci values in the 
+		 * ancestors occur through backend_attribute(), i.e.
+		 * with the identity of the operation, requiring
+		 * further access checking.  For uniformity, this
+		 * makes further requests occur as the rootdn, if
+		 * any, i.e. searching for the OpenLDAPaci attribute
+		 * is considered an internal search.  If this is not
+		 * acceptable, then the same check needs be performed
+		 * when accessing the entry's attribute. */
+		Operation	op2 = *op;
+
+		if ( !BER_BVISNULL( &op->o_bd->be_rootndn ) ) {
+			op2.o_dn = op->o_bd->be_rootdn;
+			op2.o_ndn = op->o_bd->be_rootndn;
+		}
+#endif
 
 		dnParent( &e->e_nname, &parent_ndn );
-		while ( parent_ndn.bv_val != old_parent_ndn.bv_val ){
+		while ( !BER_BVISEMPTY( &parent_ndn ) ){
 			int		i;
 			BerVarray	bvals = NULL;
 			int		ret, stop;
 
-			old_parent_ndn = parent_ndn;
 			Debug( LDAP_DEBUG_ACL, "checking ACI of \"%s\"\n", parent_ndn.bv_val, 0, 0 );
-			ret = backend_attribute( op, NULL, &parent_ndn, ad, &bvals, ACL_AUTH );
+			ret = backend_attribute( &op2, NULL, &parent_ndn, ad, &bvals, ACL_AUTH );
 
 			switch ( ret ) {
 			case LDAP_SUCCESS :
@@ -2705,8 +3328,8 @@ dynacl_aci_mask(
 						}
 					}
 					Debug( LDAP_DEBUG_ACL, "<= aci_mask grant %s deny %s\n", 
-						accessmask2str( tgrant, accessmaskbuf ),
-						accessmask2str( tdeny, accessmaskbuf1 ), 0 );
+						accessmask2str( tgrant, accessmaskbuf, 1 ),
+						accessmask2str( tdeny, accessmaskbuf1, 1 ), 0 );
 				}
 				break;
 
@@ -2732,7 +3355,7 @@ dynacl_aci_mask(
 			if ( stop ) {
 				break;
 			}
-			dnParent( &old_parent_ndn, &parent_ndn );
+			dnParent( &parent_ndn, &parent_ndn );
 		}
 	}
 
@@ -2746,18 +3369,18 @@ dynacl_aci_mask(
 static slap_dynacl_t	dynacl_aci = {
 	"aci",
 	dynacl_aci_parse,
-	dynacl_aci_print,
+	dynacl_aci_unparse,
 	dynacl_aci_mask,
 	NULL,
 	NULL,
 	NULL
 };
 
-int
-aci_init( void )
-{
-	return slap_dynacl_register( &dynacl_aci );
-}
+#endif /* SLAP_DYNACL */
+
+#endif	/* SLAPD_ACI_ENABLED */
+
+#ifdef SLAP_DYNACL
 
 /*
  * dynamic ACL infrastructure
@@ -2817,23 +3440,26 @@ slap_dynacl_get( const char *name )
 int
 acl_init( void )
 {
+	int		i, rc;
 #ifdef SLAP_DYNACL
-	int		rc;
-
-	da_list = NULL;
-
+	slap_dynacl_t	*known_dynacl[] = {
 #ifdef SLAPD_ACI_ENABLED
-	rc = aci_init();
-	if ( rc ) {
-		return rc;
+		&dynacl_aci,
+#endif  /* SLAPD_ACI_ENABLED */
+		NULL
+	};
+
+	for ( i = 0; known_dynacl[ i ]; i++ ) {
+		rc = slap_dynacl_register( known_dynacl[ i ] ); 
+		if ( rc ) {
+			return rc;
+		}
 	}
-#endif /* SLAPD_ACI_ENABLED */
 #endif /* SLAP_DYNACL */
 
 	return 0;
 }
 
-
 static int
 string_expand(
 	struct berval	*bv,