dynacl behavior

[Howard Chu <hyc@symas.com>]

In this section of code, I believe the ACL_INIT's should be 
ACL_INVALIDATEs instead, otherwise the final test "see if we have 
anything to contribute" is always skipped.
Agreed?

           /* start out with nothing granted, nothing denied */
           ACL_INIT(tgrant);
           ACL_INIT(tdeny);

           for ( da = b->a_dynacl; da; da = da->da_next ) {
               slap_access_t   grant,
                       deny;

               ACL_INIT(grant);
               ACL_INIT(deny);

               Debug( LDAP_DEBUG_ACL, "    <= check a_dynacl: %s\n",
                   da->da_name, 0, 0 );

               (void)( *da->da_mask )( da->da_private, op, e, desc, 
val, nmatch, matches, &grant, &deny );

               tgrant |= grant;
               tdeny |= deny;
           }

           /* remove anything that the ACL clause does not allow */
           tgrant &= b->a_access_mask & ACL_PRIV_MASK;
           tdeny &= ACL_PRIV_MASK;

           /* see if we have anything to contribute */
           if( ACL_IS_INVALID(tgrant) && ACL_IS_INVALID(tdeny) ) {
               continue;
           }

--
 -- Howard Chu
 Chief Architect, Symas Corp.  http://www.symas.com
 Director, Highland Sun        http://highlandsun.com/hyc
 OpenLDAP Core Team            http://www.openldap.org/project/