Re: SLAPD: Should access checks take place before filter matching?

[Simon Spero <ses@tipper.oit.unc.edu>]

On Fri, 22 Jun 2001, Kurt D. Zeilenga wrote:
> than with the most simple filters, returning False and returning
> non-True are NOT equivalent.
>
> If I gather what you are suggesting correctly,
>         (userPassword=secret) is Undefined and entry is not returned.
>         (!(userPassword=secret)) is True and entry is returned.

test_filter returns a lifted boolean, but the functions that call
test_filter only test to see if the value is TRUE, and only send a result
in that case. If the value is anything other than TRUE (i.e. FALSE or
BOTTOM), no result is returned.  This is true for everywhere in the code
where test_filter is called.

For example, in back-ldbm/search.c:305, test_filter is called as

if ( test_filter( be, conn, op, e, filter ) == LDAP_COMPARE_TRUE ) {
	[...]
}