disallow more root dse operations

servers/slapd/compare.c

@@ -93,6 +93,13 @@ do_compare(
 		goto cleanup;
 	}
 
+	if( ndn == '\0' ) {
+		Debug( LDAP_DEBUG_ANY, "do_compare: root dse!\n", 0, 0, 0 );
+		send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
+			NULL, "compare upon the root DSE not supported", NULL, NULL );
+		goto cleanup;
+	}
+
 	/*
 	 * We could be serving multiple database backends.  Select the
 	 * appropriate one, or send a referral to our "referral server"

servers/slapd/modify.c

@@ -145,6 +145,13 @@ do_modify(
 		goto cleanup;
 	}
 
+	if( ndn == '\0' ) {
+		Debug( LDAP_DEBUG_ANY, "do_modify: root dse!\n", 0, 0, 0 );
+		send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
+			NULL, "modify upon the root DSE not supported", NULL, NULL );
+		goto cleanup;
+	}
+
 #ifdef LDAP_DEBUG
 	Debug( LDAP_DEBUG_ARGS, "modifications:\n", 0, 0, 0 );
 	for ( tmp = modlist; tmp != NULL; tmp = tmp->ml_next ) {

servers/slapd/modrdn.c

@@ -150,6 +150,13 @@ do_modrdn(
 		goto cleanup;
 	}
 
+	if( ndn == '\0' ) {
+		Debug( LDAP_DEBUG_ANY, "do_modrdn: root dse!\n", 0, 0, 0 );
+		send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
+			NULL, "cannot rename the root DSE", NULL, NULL );
+		goto cleanup;
+	}
+
 	Statslog( LDAP_DEBUG_STATS, "conn=%ld op=%d MODRDN dn=\"%s\"\n",
 	    op->o_connid, op->o_opid, dn, 0, 0 );