Add ignore-subtree and restrict-subtree settings

Add {nis,schema-compat}-ignore-subtree (subtrees under which we ignore
contents and updates )and {nis,schema-compat}-restrict-subtree (subtrees
out of which we ignore contents and updates, if set) settings, and
default the former to "cn=tasks,cn=config".

This should avoid cases where we're looking through the ldbm backend for
entries which have a dangling reference to a newly-added task (which,
because it's in the DSE, means we acquire an ldbm lock after acquiring
our internal lock) while also updating a compat entry after its source
entry is modified (for example, by the memberOf plugin, which results in
us attempting to acquire our lock while the ldbm lock is already held).

2 files changed, 34 insertions, 16 deletions

diff --git a/doc/nis-configuration.txt b/doc/nis-configuration.txt
index 577a051..8f8df9f 100644
--- a/doc/nis-configuration.txt
+++ b/doc/nis-configuration.txt
@@ -58,37 +58,37 @@ look like this:
 Configuration for individual maps should be stored in entries directly
 beneath the plugin's entry.  These attributes are recognized:
 
- * nis-domain
+ * nis-domain (required, multivalued)
    The NIS domain in which this map appears.  The server will claim to
    support any domain for which it has at least one map configured.
    There is no default value, and a single map will appear in multiple
    domains if this attribute has multiple values.
- * nis-map
+ * nis-map (required, multivalued)
    The name of this map in the domain.  There is no default value, and a
    single map will appear with multiple names if this attribute has
    multiple values.
- * nis-base
+ * nis-base (required, multivalued)
    The entry under which directory server entries which should be
    converted into NIS map entries can be found.  There is no default
    setting.  If this attribute has more than one value, the resulting
    NIS map will include every entry which can be found by searching
    under all of the specified entries.
- * nis-secure
+ * nis-secure (optional)
    Indicates that the contents of this map should only be visible to
    clients whose queries originated from port numbers below 1024.  The
    default setting for all maps is "no".
- * nis-filter
+ * nis-filter (optional)
    The filter which is used to select entries for conversion, given as
    an LDAP search filter.  A default value, which varies based on the
    name of the map, is used if none is specified.
- * nis-key-format
+ * nis-key-format (required if nis-keys-format is not set)
    A format specifier which the plugin will use to convert the contents
    of the directory server entry into a key for the NIS map.  If the
    expression fails to evaluate, or evaluates to more than one value,
    the entry will be ignored.  This can be used to ensure a 1-to-1
    mapping between entries in the directory server and a NIS map.  The
    syntax of format specifiers is described in "format-specifiers.txt".
- * nis-keys-format
+ * nis-keys-format (required if nis-key-format is not set, multivalued)
    A format specifier which the plugin will use to convert the contents
    of the directory server entry into a set of keys for the NIS map.
    The resulting NIS map will include a key for each value to which the
@@ -96,12 +96,12 @@ beneath the plugin's entry.  These attributes are recognized:
    number of NIS map entries to be created for a given directory server
    entry.  The syntax of format specifiers is described in
    "format-specifiers.txt".
- * nis-value-format
+ * nis-value-format (required if nis-values-format is not set)
    A format specifier which the plugin will use to convert the contents
    of the directory server entry into a NIS map entry's value.  If the
    entry will have multiple keys, each key will use the same value.  The
    syntax of format specifiers is described in "format-specifiers.txt".
- * nis-values-format
+ * nis-values-format (required if nis-value-format is not set)
    A format specifier which the plugin will use to convert the contents
    of the directory server entry into values for NIS map entries.
    Typically this will be used in combination with a "nis-keys-format"
@@ -109,10 +109,19 @@ beneath the plugin's entry.  These attributes are recognized:
    server entry.  If there are fewer values than keys, the values will
    be reused.  The syntax of format specifiers is described in
    "format-specifiers.txt".
- * nis-disallowed-chars
+ * nis-disallowed-chars (optional)
    A list of characters which, if found in an attribute value, will
    cause that attribute value to be ignored when evaluating keys and
    values.
+ * nis-ignore-subtree (optional, multivalued)
+   An optional set of subtrees under which the plugin will ignore all
+   content and updates.  By default, this is set to "cn=tasks,cn=config".
+ * nis-restrict-subtree (optional, multivalued)
+   An optional set of subtrees from under which the plugin will only
+   consider content and updates.  If you have a large DIT and many
+   maps, using this setting may reduce the amount of work the plugin
+   has to do, by short-circuiting possibly-expensive checks to see if
+   an entry being modified affects the contents of various maps.
 
 The nis-filter, nis-key-format, nis-keys-format, nis-value-format, and
 nis-values-format settings all have defaults which vary based on the
diff --git a/doc/sch-configuration.txt b/doc/sch-configuration.txt
index 93e5298..e07a4af 100644
--- a/doc/sch-configuration.txt
+++ b/doc/sch-configuration.txt
@@ -20,24 +20,33 @@ look like this:
 Configuration for individual sets should be stored in entries directly
 beneath the plugin's entry.  These attributes are recognized:
 
- * schema-compat-container-group
+ * schema-compat-container-group (required)
    The top-level container DN under which this container's entry
    appears.  This level of grouping is primarily useful when using the
    ''referred'' function.
- * schema-compat-container-rdn
+ * schema-compat-container-rdn (optional)
    The RDN of this particular container.  If it's omitted, generated
    entries will show up directly in the container group.
- * schema-compat-search-base
+ * schema-compat-search-base (required, multivalued)
    One or more locations in the directory where candidate entries can be
    found.
- * schema-compat-search-filter
+ * schema-compat-search-filter (required)
    A filter used to select which candidate entries should have new
    entries created for them in this container.
- * schema-compat-entry-rdn
+ * schema-compat-entry-rdn (required)
    The RDN to give to generated entries, which will be stored as
    children of this container.
- * schema-compat-entry-attribute
+ * schema-compat-entry-attribute (optional, multivalued)
    Additional attributes to add to each entry in this container.
+ * schema-compat-ignore-subtree (optional, multivalued)
+   An optional set of subtrees under which the plugin will ignore all
+   content and updates.  By default, this is set to "cn=tasks,cn=config".
+ * schema-compat-restrict-subtree (optional, multivalued)
+   An optional set of subtrees from under which the plugin will only
+   consider content and updates.  If you have a large DIT and many
+   maps, using this setting may reduce the amount of work the plugin
+   has to do, by short-circuiting possibly-expensive checks to see if
+   an entry being modified affects the contents of various maps.
 
 An pair of example definitions might look like this: