(ITS#5344) Wrong check for bad Modify DN

[h.b.furuseth@usit.uio.no]

Full_Name: Hallvard B Furuseth
Version: HEAD
OS: 
URL: http://folk.uio.no/hbf/OpenLDAP/modrdn.diff
Submission from: (NULL) (129.240.6.233)
Submitted by: hallvard


The slapd/modrdn.c check for affectsMultipleDSAs is insufficient, it
requires newSuperior to be in the same backend.  That does not catch
moving "cn=x,cn=y" to another database's suffix "cn=z,cn=y".  Also
if a database has multiple suffixes it prevents moving an entry
to one of the suffixes.

slapd/modrdn.c can catch attempts to place an entry above/below itself.
It doesn't need to send those to the database and hope that catches it.
This patch puts it in the frontend (fe_op_modrdn); that needed to
generate the destination DN anyway for the affectsMultipleDSAs check.
Not sure if that's right or if it should go in do_modrdn() instead.
(I'm thinking of DN rewriting in rwm, vs. global overlays.)

In test005-modrdn, the "modrdn with newSuperior as child of target" check
would not catch anything: It expects failure, but the newSuperior did
not exist and would fail with noSuchObject in any case.  This patch uses
newSuperior=target instead, and expects unwillingToPerform.

I'll apply the patch later, unless someone thinks it should be done
differently.