Only check opinfo.boi_err when ACL check failed.

diff --git a/servers/slapd/back-bdb/add.c b/servers/slapd/back-bdb/add.c
index 20aa3193dbac9f06e4bf4d8f33c1ed1e79b199b3..b7c47dadb42f9f3fdd4b7d455f564b87df69e163 100644 (file)
--- a/servers/slapd/back-bdb/add.c
+++ b/servers/slapd/back-bdb/add.c
@@ -218,13 +218,13 @@ retry:    /* transaction retry */
                rc = access_allowed( be, conn, op, p,
                        children, NULL, ACL_WRITE, NULL );
 
-               switch( opinfo.boi_err ) {
-               case DB_LOCK_DEADLOCK:
-               case DB_LOCK_NOTGRANTED:
-                       goto retry;
-               }
-
                if ( ! rc ) {
+                       switch( opinfo.boi_err ) {
+                       case DB_LOCK_DEADLOCK:
+                       case DB_LOCK_NOTGRANTED:
+                               goto retry;
+                       }
+
 #ifdef NEW_LOGGING
                        LDAP_LOG ( OPERATION, DETAIL1, 
                                "bdb_add: no write access to parent\n", 0, 0, 0 );
@@ -318,13 +318,13 @@ retry:    /* transaction retry */
 
                                p = NULL;
 
-                               switch( opinfo.boi_err ) {
-                               case DB_LOCK_DEADLOCK:
-                               case DB_LOCK_NOTGRANTED:
-                                       goto retry;
-                               }
-
                                if ( ! rc ) {
+                                       switch( opinfo.boi_err ) {
+                                       case DB_LOCK_DEADLOCK:
+                                       case DB_LOCK_NOTGRANTED:
+                                               goto retry;
+                                       }
+
 #ifdef NEW_LOGGING
                                        LDAP_LOG ( OPERATION, DETAIL1, 
                                                "bdb_add: no write access to parent\n", 0, 0, 0 );
@@ -381,13 +381,13 @@ retry:    /* transaction retry */
        rc = access_allowed( be, conn, op, e,
                entry, NULL, ACL_WRITE, NULL );
 
-       switch( opinfo.boi_err ) {
-       case DB_LOCK_DEADLOCK:
-       case DB_LOCK_NOTGRANTED:
-               goto retry;
-       }
-
        if ( ! rc ) {
+               switch( opinfo.boi_err ) {
+               case DB_LOCK_DEADLOCK:
+               case DB_LOCK_NOTGRANTED:
+                       goto retry;
+               }
+
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, DETAIL1, 
                        "bdb_add: no write access to entry\n", 0, 0, 0 );

diff --git a/servers/slapd/back-bdb/delete.c b/servers/slapd/back-bdb/delete.c
index 3aff606e7136bb4f63898942f91b080f80b96bfa..079b44081ca4e2b3155167a3924e99be92b35422 100644 (file)
--- a/servers/slapd/back-bdb/delete.c
+++ b/servers/slapd/back-bdb/delete.c
@@ -164,13 +164,13 @@ retry:    /* transaction retry */
                bdb_unlocked_cache_return_entry_r(&bdb->bi_cache, p);
                p = NULL;
 
-               switch( opinfo.boi_err ) {
-               case DB_LOCK_DEADLOCK:
-               case DB_LOCK_NOTGRANTED:
-                       goto retry;
-               }
-
                if ( !rc  ) {
+                       switch( opinfo.boi_err ) {
+                       case DB_LOCK_DEADLOCK:
+                       case DB_LOCK_NOTGRANTED:
+                               goto retry;
+                       }
+
 #ifdef NEW_LOGGING
                        LDAP_LOG ( OPERATION, DETAIL1, 
                                "<=- bdb_delete: no write access to parent\n", 0, 0, 0 );
@@ -197,13 +197,13 @@ retry:    /* transaction retry */
 
                                p = NULL;
 
-                               switch( opinfo.boi_err ) {
-                               case DB_LOCK_DEADLOCK:
-                               case DB_LOCK_NOTGRANTED:
-                                       goto retry;
-                               }
-
                                if ( !rc  ) {
+                                       switch( opinfo.boi_err ) {
+                                       case DB_LOCK_DEADLOCK:
+                                       case DB_LOCK_NOTGRANTED:
+                                               goto retry;
+                                       }
+
 #ifdef NEW_LOGGING
                                        LDAP_LOG ( OPERATION, DETAIL1, 
                                                "<=- bdb_delete: no access to parent\n", 0, 0, 0 );
@@ -300,13 +300,13 @@ retry:    /* transaction retry */
        rc = access_allowed( be, conn, op, e,
                entry, NULL, ACL_WRITE, NULL );
 
-       switch( opinfo.boi_err ) {
-       case DB_LOCK_DEADLOCK:
-       case DB_LOCK_NOTGRANTED:
-               goto retry;
-       }
-
        if ( !rc  ) {
+               switch( opinfo.boi_err ) {
+               case DB_LOCK_DEADLOCK:
+               case DB_LOCK_NOTGRANTED:
+                       goto retry;
+               }
+
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, DETAIL1, 
                        "<=- bdb_delete: no write access to entry\n", 0, 0, 0 );

diff --git a/servers/slapd/back-bdb/modify.c b/servers/slapd/back-bdb/modify.c
index 98fc5edd906d843f461ec4a87617419545986a6d..167938a9605af9f4c25798b9987c15019d418759 100644 (file)
--- a/servers/slapd/back-bdb/modify.c
+++ b/servers/slapd/back-bdb/modify.c
@@ -451,6 +451,9 @@ retry:      /* transaction retry */
                        "bdb_modify: modify failed (%d)\n",
                        rc, 0, 0 );
 #endif
+               if ( (rc == LDAP_INSUFFICIENT_ACCESS) && opinfo.boi_err ) {
+                       rc = opinfo.boi_err;
+               }
                switch( rc ) {
                case DB_LOCK_DEADLOCK:
                case DB_LOCK_NOTGRANTED:

diff --git a/servers/slapd/back-bdb/modrdn.c b/servers/slapd/back-bdb/modrdn.c
index e3f054d1f576c48e3788c09be2b4a42ad127321c..27854b3a30191aaeb94e2d31d31f006ddc8120d7 100644 (file)
--- a/servers/slapd/back-bdb/modrdn.c
+++ b/servers/slapd/back-bdb/modrdn.c
@@ -193,13 +193,13 @@ retry:    /* transaction retry */
        /* check write on old entry */
        rc = access_allowed( be, conn, op, e, entry, NULL, ACL_WRITE, NULL );
 
-       switch( opinfo.boi_err ) {
-       case DB_LOCK_DEADLOCK:
-       case DB_LOCK_NOTGRANTED:
-               goto retry;
-       }
-
        if ( ! rc ) {
+               switch( opinfo.boi_err ) {
+               case DB_LOCK_DEADLOCK:
+               case DB_LOCK_NOTGRANTED:
+                       goto retry;
+               }
+
 #ifdef NEW_LOGGING
                LDAP_LOG ( OPERATION, ERR, 
                        "==>bdb_modrdn: no access to entry\n", 0, 0, 0 );
@@ -278,13 +278,13 @@ retry:    /* transaction retry */
                rc = access_allowed( be, conn, op, p,
                        children, NULL, ACL_WRITE, NULL );
 
-               switch( opinfo.boi_err ) {
-               case DB_LOCK_DEADLOCK:
-               case DB_LOCK_NOTGRANTED:
-                       goto retry;
-               }
-
                if ( ! rc ) {
+                       switch( opinfo.boi_err ) {
+                       case DB_LOCK_DEADLOCK:
+                       case DB_LOCK_NOTGRANTED:
+                               goto retry;
+                       }
+
                        rc = LDAP_INSUFFICIENT_ACCESS;
 #ifdef NEW_LOGGING
                        LDAP_LOG ( OPERATION, ERR, 
@@ -334,15 +334,15 @@ retry:    /* transaction retry */
                                rc = access_allowed( be, conn, op, p,
                                        children, NULL, ACL_WRITE, NULL );
 
-                               switch( opinfo.boi_err ) {
-                               case DB_LOCK_DEADLOCK:
-                               case DB_LOCK_NOTGRANTED:
-                                       goto retry;
-                               }
-
                                p = NULL;
 
                                if ( ! rc ) {
+                                       switch( opinfo.boi_err ) {
+                                       case DB_LOCK_DEADLOCK:
+                                       case DB_LOCK_NOTGRANTED:
+                                               goto retry;
+                                       }
+
                                        rc = LDAP_INSUFFICIENT_ACCESS;
 #ifdef NEW_LOGGING
                                        LDAP_LOG ( OPERATION, ERR, 
@@ -481,13 +481,13 @@ retry:    /* transaction retry */
                        rc = access_allowed( be, conn, op, np, children,
                                NULL, ACL_WRITE, NULL );
 
-                       switch( opinfo.boi_err ) {
-                       case DB_LOCK_DEADLOCK:
-                       case DB_LOCK_NOTGRANTED:
-                               goto retry;
-                       }
-
                        if( ! rc ) {
+                               switch( opinfo.boi_err ) {
+                               case DB_LOCK_DEADLOCK:
+                               case DB_LOCK_NOTGRANTED:
+                                       goto retry;
+                               }
+
 #ifdef NEW_LOGGING
                                LDAP_LOG ( OPERATION, DETAIL1, 
                                        "==>bdb_modrdn: no wr to newSup children\n", 0, 0, 0 );
@@ -548,15 +548,15 @@ retry:    /* transaction retry */
                                        rc = access_allowed( be, conn, op, np,
                                                children, NULL, ACL_WRITE, NULL );
 
-                                       switch( opinfo.boi_err ) {
-                                       case DB_LOCK_DEADLOCK:
-                                       case DB_LOCK_NOTGRANTED:
-                                               goto retry;
-                                       }
-
                                        np = NULL;
 
                                        if ( ! rc ) {
+                                               switch( opinfo.boi_err ) {
+                                               case DB_LOCK_DEADLOCK:
+                                               case DB_LOCK_NOTGRANTED:
+                                                       goto retry;
+                                               }
+
                                                rc = LDAP_INSUFFICIENT_ACCESS;
 #ifdef NEW_LOGGING
                                                LDAP_LOG ( OPERATION, ERR, 
@@ -771,6 +771,9 @@ retry:      /* transaction retry */
                &text, textbuf, textlen );
 
        if( rc != LDAP_SUCCESS ) {
+               if ( ( rc == LDAP_INSUFFICIENT_ACCESS ) && opinfo.boi_err ) {
+                       rc = opinfo.boi_err;
+               }
                switch( rc ) {
                case DB_LOCK_DEADLOCK:
                case DB_LOCK_NOTGRANTED:

diff --git a/servers/slapd/back-bdb/passwd.c b/servers/slapd/back-bdb/passwd.c
index d258265e22c27eec1d66dc3d084aefeae2ff3b3d..685a187cbd2c60ac522861181e3309a8279defd6 100644 (file)
--- a/servers/slapd/back-bdb/passwd.c
+++ b/servers/slapd/back-bdb/passwd.c
@@ -227,6 +227,9 @@ retry:      /* transaction retry */
                rc = bdb_modify_internal( be, conn, op, ltid,
                        &ml, e, text, textbuf, textlen );
 
+               if ( (rc == LDAP_INSUFFICIENT_ACCESS) && opinfo.boi_err ) {
+                       rc = opinfo.boi_err;
+               }
                switch(rc) {
                case DB_LOCK_DEADLOCK:
                case DB_LOCK_NOTGRANTED: