From 1bc7cd0e2aa7a5545df109cb046b4b76fdde591b Mon Sep 17 00:00:00 2001
From: Howard Chu <hyc@openldap.org>
Date: Tue, 7 Oct 2025 19:12:12 +0100
Subject: [PATCH] ITS#10398 slapo-memberof/refint: fix clash on subtree renames

memberof must ignore modify ops from refint overlay.
---
 servers/slapd/overlays/memberof.c | 8 ++++++--
 servers/slapd/overlays/refint.c   | 6 ++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/servers/slapd/overlays/memberof.c b/servers/slapd/overlays/memberof.c
index 46232e45c8..ac73c84b4b 100644
--- a/servers/slapd/overlays/memberof.c
+++ b/servers/slapd/overlays/memberof.c
@@ -136,6 +136,7 @@ static AttributeDescription	*ad_memberOf;
 static ObjectClass			*oc_group;
 
 static slap_overinst		memberof;
+static slap_overinst		*oi_refint;
 
 typedef struct memberof_t {
 	struct berval		mo_dn;
@@ -906,6 +907,8 @@ memberof_op_modify( Operation *op, SlapReply *rs )
 	LDAP_SLIST_FOREACH( oex, &op->o_extra, oe_next ) {
 		if ( oex->oe_key == (void *)&memberof )
 			return SLAP_CB_CONTINUE;
+		if ( oi_refint && oex->oe_key == oi_refint )
+			return SLAP_CB_CONTINUE;
 	}
 
 	if ( MEMBEROF_REVERSE( mo ) ) {
@@ -2154,8 +2157,7 @@ mo_cf_gen( ConfigArgs *c )
 				if ( SLAP_ISGLOBALOVERLAY( c->be ) ) {
 					snprintf( c->cr_msg, sizeof( c->cr_msg ),
 						"addcheck functionality not supported "
-						"when memberof is a global overlay",
-						c->argv[ 1 ] );
+						"when memberof is a global overlay" );
 					Debug( LDAP_DEBUG_ANY, "%s: %s.\n",
 						c->log, c->cr_msg );
 					return 1;
@@ -2211,6 +2213,8 @@ memberof_db_open(
 		memberof_make_member_filter( mo );
 	}
 
+	oi_refint = overlay_find( "refint" );
+
 	return 0;
 }
 
diff --git a/servers/slapd/overlays/refint.c b/servers/slapd/overlays/refint.c
index 1bcaf0ee9d..ddea9d6b38 100644
--- a/servers/slapd/overlays/refint.c
+++ b/servers/slapd/overlays/refint.c
@@ -596,6 +596,7 @@ refint_repair(
 	unsigned long	opid;
 	int		rc;
 	int	cache;
+	OpExtra oex;
 
 	op->o_callback->sc_response = refint_search_cb;
 	op->o_req_dn = op->o_bd->be_suffix[ 0 ];
@@ -638,6 +639,11 @@ refint_repair(
 
 	opid = op->o_opid;
 	op2 = *op;
+
+	/* mark this mod as one of ours */
+	oex.oe_key = (void *)&refint;
+	LDAP_SLIST_INSERT_HEAD( &op2.o_extra, &oex, oe_next );
+
 	for ( dp = rq->attrs; dp; dp = dp->next ) {
 		SlapReply	rs2 = {REP_RESULT};
 		refint_attrs	*ra;