RE23 seems to still need these ACL states

diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index 954714cf7778e649f808d42cacc1d8fed9bb92cb..b3fe310d45d09798acd29e1184320bd0c013f64d 100644 (file)
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -649,6 +649,17 @@ slap_acl_get(
        return( NULL );
 }
 
+/*
+ * Record value-dependent access control state
+ */
+#define ACL_RECORD_VALUE_STATE do { \
+               if( state && !( state->as_recorded & ACL_STATE_RECORDED_VD )) { \
+                       state->as_recorded |= ACL_STATE_RECORDED_VD; \
+                       state->as_vd_acl = a; \
+                       state->as_vd_acl_count = count; \
+               } \
+       } while( 0 )
+
 static int
 acl_mask_dn(
        Operation               *op,
@@ -996,6 +1007,8 @@ acl_mask_dnattr(
                if ( ! bdn->a_self )
                        return 1;
 
+               ACL_RECORD_VALUE_STATE;
+
                /* this is a self clause, check if the target is an
                 * attribute.
                 */
@@ -1603,6 +1616,8 @@ slap_acl_mask(
                        const char *dummy;
                        int rc, match = 0;
 
+                       ACL_RECORD_VALUE_STATE;
+
                        /* must have DN syntax */
                        if ( desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName &&
                                !is_at_syntax( desc->ad_type, SLAPD_NAMEUID_SYNTAX )) continue;