On Wed, Jun 08, 2016 at 10:15:13PM +0000, hyc@symas.com wrote:

okuznik@symas.com wrote:

...

With cn=config the ConfigLDAPadd function might have to allocate resources that are needed by the time the attributes/config directives are being processed since there is no indication which directives there are and what order they come in.

When using LDAPAdd, attributes are processed in the order of their schema definitions.

...

If any of the config values fail validation, the configuration code has to react and clean up - which is possible using ca->cleanup.

No, that's not its purpose. If anything fails, the entire config entry must be wiped out. LDAPAdd is all-or-nothing.

Yes, but the resource usually has to be allocated before the any of the attributes are processed. In case of failure, the overlay does not have a chance to react and free it since it has no idea when the reversal of all of the attributes has finished.