From 262c44772da0aba23de5b8a69aa997b1b24c760d Mon Sep 17 00:00:00 2001 From: Howard Chu Date: Sat, 10 Sep 2005 01:16:55 +0000 Subject: [PATCH] ITS#2757 remove be_isroot checks, simplify... --- servers/slapd/back-bdb/modrdn.c | 204 +++++++++++--------------------- 1 file changed, 70 insertions(+), 134 deletions(-) diff --git a/servers/slapd/back-bdb/modrdn.c b/servers/slapd/back-bdb/modrdn.c index 0a6b8d7fd2..16025c4c48 100644 --- a/servers/slapd/back-bdb/modrdn.c +++ b/servers/slapd/back-bdb/modrdn.c @@ -29,7 +29,6 @@ bdb_modrdn( Operation *op, SlapReply *rs ) AttributeDescription *entry = slap_schema.si_ad_entry; struct berval p_dn, p_ndn; struct berval new_dn = {0, NULL}, new_ndn = {0, NULL}; - int isroot = -1; Entry *e = NULL; Entry *p = NULL; EntryInfo *ei = NULL, *eip = NULL, *nei = NULL, *neip = NULL; @@ -253,7 +252,15 @@ retry: /* transaction retry */ } if ( be_issuffix( op->o_bd, &e->e_nname ) ) { +#ifdef BDB_MULTIPLE_SUFFIXES + /* Allow renaming one suffix entry to another */ p_ndn = slap_empty_bv; +#else + /* There can only be one suffix entry */ + rs->sr_err = LDAP_NAMING_VIOLATION; + rs->sr_text = "cannot rename suffix entry"; + goto return_results; +#endif } else { dnParent( &e->e_nname, &p_ndn ); } @@ -290,101 +297,48 @@ retry: /* transaction retry */ rs->sr_text = "old entry's parent does not exist"; goto return_results; } + } else { + p = (Entry *)&slap_entry_root; + } - /* check parent for "children" acl */ - rs->sr_err = access_allowed( op, p, - children, NULL, - op->oq_modrdn.rs_newSup == NULL ? - ACL_WRITE : ACL_WDEL, - NULL ); + /* check parent for "children" acl */ + rs->sr_err = access_allowed( op, p, + children, NULL, + op->oq_modrdn.rs_newSup == NULL ? + ACL_WRITE : ACL_WDEL, + NULL ); - if ( ! rs->sr_err ) { - switch( opinfo.boi_err ) { - case DB_LOCK_DEADLOCK: - case DB_LOCK_NOTGRANTED: - goto retry; - } - - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - Debug( LDAP_DEBUG_TRACE, "no access to parent\n", 0, - 0, 0 ); - rs->sr_text = "no write access to old parent's children"; - goto return_results; - } + if ( !p_ndn.bv_len ) + p = NULL; - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) ": wr to children " - "of entry %s OK\n", p_ndn.bv_val, 0, 0 ); - - if ( p_ndn.bv_val == slap_empty_bv.bv_val ) { - p_dn = slap_empty_bv; - } else { - dnParent( &e->e_name, &p_dn ); + if ( ! rs->sr_err ) { + switch( opinfo.boi_err ) { + case DB_LOCK_DEADLOCK: + case DB_LOCK_NOTGRANTED: + goto retry; } - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) ": parent dn=%s\n", - p_dn.bv_val, 0, 0 ); + rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + Debug( LDAP_DEBUG_TRACE, "no access to parent\n", 0, + 0, 0 ); + rs->sr_text = "no write access to old parent's children"; + goto return_results; + } + Debug( LDAP_DEBUG_TRACE, + LDAP_XSTRING(bdb_modrdn) ": wr to children " + "of entry %s OK\n", p_ndn.bv_val, 0, 0 ); + + if ( p_ndn.bv_val == slap_empty_bv.bv_val ) { + p_dn = slap_empty_bv; } else { - /* no parent, modrdn entry directly under root */ - isroot = be_isroot( op ); - if ( ! isroot ) { - if ( be_issuffix( op->o_bd, (struct berval *)&slap_empty_bv ) - || be_shadow_update( op ) ) { - - p = (Entry *)&slap_entry_root; - - /* check parent for "children" acl */ - rs->sr_err = access_allowed( op, p, - children, NULL, - op->oq_modrdn.rs_newSup == NULL ? - ACL_WRITE : ACL_WDEL, - NULL ); - - p = NULL; - - if ( ! rs->sr_err ) { - switch( opinfo.boi_err ) { - case DB_LOCK_DEADLOCK: - case DB_LOCK_NOTGRANTED: - goto retry; - } - - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - Debug( LDAP_DEBUG_TRACE, - "no access to parent\n", - 0, 0, 0 ); - rs->sr_text = "no write access to old parent"; - goto return_results; - } - - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) - ": wr to children of entry \"\" OK\n", - 0, 0, 0 ); - - p_dn.bv_val = ""; - p_dn.bv_len = 0; - - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) - ": parent dn=\"\"\n", - 0, 0, 0 ); - - } else { - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) - ": no parent, not root " - "& \"\" is not suffix\n", - 0, 0, 0); - rs->sr_text = "no write access to old parent"; - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - goto return_results; - } - } + dnParent( &e->e_name, &p_dn ); } + Debug( LDAP_DEBUG_TRACE, + LDAP_XSTRING(bdb_modrdn) ": parent dn=%s\n", + p_dn.bv_val, 0, 0 ); + new_parent_dn = &p_dn; /* New Parent unless newSuperior given */ if ( op->oq_modrdn.rs_newSup != NULL ) { @@ -402,6 +356,15 @@ retry: /* transaction retry */ } } + /* There's a BDB_MULTIPLE_SUFFIXES case here that this code doesn't + * support. E.g., two suffixes dc=foo,dc=com and dc=bar,dc=net. + * We do not allow modDN + * dc=foo,dc=com + * newrdn dc=bar + * newsup dc=net + * and we probably should. But since MULTIPLE_SUFFIXES is deprecated + * I'm ignoring this problem for now. + */ if ( op->oq_modrdn.rs_newSup != NULL ) { if ( op->oq_modrdn.rs_newSup->bv_len ) { np_dn = op->oq_modrdn.rs_newSup; @@ -493,62 +456,35 @@ retry: /* transaction retry */ } } else { - if ( isroot == -1 ) { - isroot = be_isroot( op ); - } - np_dn = NULL; /* no parent, modrdn entry directly under root */ - if ( ! isroot ) { - if ( be_issuffix( op->o_bd, (struct berval *)&slap_empty_bv ) - || be_isupdate( op ) ) { - np = (Entry *)&slap_entry_root; - - /* check parent for "children" acl */ - rs->sr_err = access_allowed( op, np, - children, NULL, ACL_WADD, NULL ); - - np = NULL; - - if ( ! rs->sr_err ) { - switch( opinfo.boi_err ) { - case DB_LOCK_DEADLOCK: - case DB_LOCK_NOTGRANTED: - goto retry; - } - - rs->sr_err = LDAP_INSUFFICIENT_ACCESS; - Debug( LDAP_DEBUG_TRACE, - "no access to new superior\n", - 0, 0, 0 ); - rs->sr_text = - "no write access to new superior's children"; - goto return_results; + if ( be_issuffix( op->o_bd, (struct berval *)&slap_empty_bv ) + || be_isupdate( op ) ) { + np = (Entry *)&slap_entry_root; + + /* check parent for "children" acl */ + rs->sr_err = access_allowed( op, np, + children, NULL, ACL_WADD, NULL ); + + np = NULL; + + if ( ! rs->sr_err ) { + switch( opinfo.boi_err ) { + case DB_LOCK_DEADLOCK: + case DB_LOCK_NOTGRANTED: + goto retry; } - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) - ": wr to children " - "of entry \"\" OK\n", - 0, 0, 0 ); - - } else { - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) - ": new superior=\"\", not root " - "& \"\" is not suffix\n", - 0, 0, 0 ); - rs->sr_text = "no write access to new superior's children"; rs->sr_err = LDAP_INSUFFICIENT_ACCESS; + Debug( LDAP_DEBUG_TRACE, + "no access to new superior\n", + 0, 0, 0 ); + rs->sr_text = + "no write access to new superior's children"; goto return_results; } } - - Debug( LDAP_DEBUG_TRACE, - LDAP_XSTRING(bdb_modrdn) - ": new superior=\"\"\n", - 0, 0, 0 ); } Debug( LDAP_DEBUG_TRACE, -- 2.39.5