Fixed slapd-bdb reindexing via cn=config not noticed issue (ITS#4260)

Fixed slapd-monitor connection search crash (ITS#4300)
Flapd slapd cn=config bad ACL syntax modfy crash (ITS#4306)
Fixed slapd ACL/suffix configuration issue (ITS#4307)
Added slapd-bdb(5) cachefree description

CHANGES

 OpenLDAP 2.3 Change Log
 
 OpenLDAP 2.3.16 Engineering
+	Fixed slapd-bdb reindexing via cn=config not noticed issue (ITS#4260)
+	Fixed slapd-monitor connection search crash (ITS#4300)
+	Flapd slapd cn=config bad ACL syntax modfy crash (ITS#4306)
+	Fixed slapd ACL/suffix configuration issue (ITS#4307)
 	Build environment
 		Replace sched_yield(2) on Linux with select(2) (ITS#3950)
+	Documentation
+		Added slapd-bdb(5) cachefree description
 
 OpenLDAP 2.3.15 Release
 	Fixed slapd strerror logging bug (ITS#4292)

doc/man/man5/slapd-bdb.5

@@ -46,6 +46,11 @@ Specify the size in entries of the in-memory entry cache maintained
 by the \fBbdb\fP or \fBhdb\fP backend database instance.
 The default is 1000 entries.
 .TP
+.BI cachefree \ <integer>
+Specify the number of entries to free from the entry cache when the
+cache reaches the \fBcachesize\fP limit.
+The default is 1 entry.
+.TP
 .BI checkpoint \ <kbyte>\ <min>
 Specify the frequency for checkpointing the database transaction log.
 A checkpoint operation flushes the database buffers to disk and writes

servers/slapd/aclparse.c

@@ -1983,44 +1983,49 @@ parse_acl(
 		}
 
 		if ( be != NULL ) {
-			if ( !BER_BVISNULL( &be->be_nsuffix[ 1 ] ) ) {
+			if ( be->be_nsuffix == NULL ) {
 				Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-					"scope checking only applies to single-valued "
-					"suffix databases\n",
+					"scope checking needs suffix before ACLs.\n",
 					fname, lineno, 0 );
 				/* go ahead, since checking is not authoritative */
-			}
-
-			switch ( check_scope( be, a ) ) {
-			case ACL_SCOPE_UNKNOWN:
-				Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-					"cannot assess the validity of the ACL scope within "
-					"backend naming context\n",
-					fname, lineno, 0 );
-				break;
-
-			case ACL_SCOPE_WARN:
+			} else if ( !BER_BVISNULL( &be->be_nsuffix[ 1 ] ) ) {
 				Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-					"ACL could be out of scope within backend naming context\n",
+					"scope checking only applies to single-valued "
+					"suffix databases\n",
 					fname, lineno, 0 );
-				break;
+				/* go ahead, since checking is not authoritative */
+			} else {
+				switch ( check_scope( be, a ) ) {
+				case ACL_SCOPE_UNKNOWN:
+					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
+						"cannot assess the validity of the ACL scope within "
+						"backend naming context\n",
+						fname, lineno, 0 );
+					break;
 
-			case ACL_SCOPE_PARTIAL:
-				Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-					"ACL appears to be partially out of scope within "
-					"backend naming context\n",
-					fname, lineno, 0 );
-				break;
+				case ACL_SCOPE_WARN:
+					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
+						"ACL could be out of scope within backend naming context\n",
+						fname, lineno, 0 );
+					break;
 
-			case ACL_SCOPE_ERR:
-				Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
-					"ACL appears to be out of scope within "
-					"backend naming context\n",
-					fname, lineno, 0 );
-				break;
+				case ACL_SCOPE_PARTIAL:
+					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
+						"ACL appears to be partially out of scope within "
+						"backend naming context\n",
+						fname, lineno, 0 );
+					break;
+	
+				case ACL_SCOPE_ERR:
+					Debug( LDAP_DEBUG_ACL, "%s: line %d: warning: "
+						"ACL appears to be out of scope within "
+						"backend naming context\n",
+						fname, lineno, 0 );
+					break;
 
-			default:
-				break;
+				default:
+					break;
+				}
 			}
 			acl_append( &be->be_acl, a, pos );
 

servers/slapd/back-bdb/config.c

@@ -272,7 +272,9 @@ bdb_online_index( void *ctx, void *arg )
 	}
 
 	for ( i = 0; i < bdb->bi_nattrs; i++ ) {
-		if ( bdb->bi_attrs[ i ]->ai_indexmask & BDB_INDEX_DELETING ) {
+		if ( bdb->bi_attrs[ i ]->ai_indexmask & BDB_INDEX_DELETING
+			|| bdb->bi_attrs[ i ]->ai_newmask == 0 )
+		{
 			continue;
 		}
 		bdb->bi_attrs[ i ]->ai_indexmask = bdb->bi_attrs[ i ]->ai_newmask;

servers/slapd/back-monitor/conn.c

@@ -547,6 +547,7 @@ monitor_subsys_conn_create(
 		char			*next = NULL;
 		static struct berval	nconn_bv = BER_BVC( "cn=connection " );
 
+		rc = LDAP_NO_SUCH_OBJECT;
 	       
 		/* create exactly the required entry;
 		 * the normalized DN must start with "cn=connection ",

servers/slapd/bconfig.c

@@ -3701,6 +3701,7 @@ config_modify_internal( CfEntryInfo *ce, Operation *op, SlapReply *rs,
 	ca->bi = ce->ce_bi;
 	ca->private = ce->ce_private;
 	ca->ca_entry = e;
+	ca->fname = "slapd";
 	strcpy( ca->log, "back-config" );
 
 	for (ml = op->orm_modlist; ml; ml=ml->sml_next) {