Full_Name: Matthew Hardin
Version: 2.4.32
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (69.43.206.100)


Some clients, like Oracle SGD, incorrectly implement the password policy request
control by including a zero-length control value with the request control.
OpenLDAP reports "passwordPolicyRequest control value not absent" and fails the
operation with a Protocol Error (2). While this behavior follows the letter of
RFC 4511, the control value in this case is zero-length and therefore harmless.
Failing in this case seems merely punctilious, and has no real benefit. For
reference, OpenLDAP 2.3 allowed a zero-length control value.

While I don't believe it's acceptable for clients to present malformed controls,
I do think it's sufficient, at least in this case, to log a warning and continue
processing the request.

For reference, the BER dump below shows the bind request containing the
incorrectly-formatted password policy request control as well as the various
stages of parsing. The request in this case comes from Oracle SGD 4.62.913.

ber_get_next: tag 0x30 len 89 contents:
ber_dump: buf=101fd8f00 ptr=101fd8f00 end=101fd8f59 len=89
 0000:  02 01 01 60 33 02 01 03  04 27 63 6e 3d 70 70 6f   ...`3....'cn=ppo  
 0010:  6c 69 63 79 74 73 74 2c  6f 75 3d 50 6f 6c 69 63   licytst,ou=Polic  
 0020:  69 65 73 2c 64 63 3d 76  73 6f 2c 64 63 3d 63 6f   ies,dc=vso,dc=co  
 0030:  6d 80 05 61 61 61 61 61  a0 1f 30 1d 04 19 31 2e   m..aaaaa..0...1.  
 0040:  33 2e 36 2e 31 2e 34 2e  31 2e 34 32 2e 32 2e 32   3.6.1.4.1.42.2.2  
 0050:  37 2e 38 2e 35 2e 31 04  00                        7.8.5.1..         
502a936b op tag 0x60, time 1344967531
ber_get_next
502a936b conn=1001 op=0 do_bind
ber_scanf fmt ({imt) ber:
ber_dump: buf=101fd8f00 ptr=101fd8f03 end=101fd8f59 len=86
 0000:  60 33 02 01 03 04 27 63  6e 3d 70 70 6f 6c 69 63   `3....'cn=ppolic  
 0010:  79 74 73 74 2c 6f 75 3d  50 6f 6c 69 63 69 65 73   ytst,ou=Policies  
 0020:  2c 64 63 3d 76 73 6f 2c  64 63 3d 63 6f 6d 80 05   ,dc=vso,dc=com..  
 0030:  61 61 61 61 61 a0 1f 30  1d 04 19 31 2e 33 2e 36   aaaaa..0...1.3.6  
 0040:  2e 31 2e 34 2e 31 2e 34  32 2e 32 2e 32 37 2e 38   .1.4.1.42.2.27.8  
 0050:  2e 35 2e 31 04 00                                  .5.1..            
ber_scanf fmt (m}) ber:
ber_dump: buf=101fd8f00 ptr=101fd8f31 end=101fd8f59 len=40
 0000:  00 05 61 61 61 61 61 a0  1f 30 1d 04 19 31 2e 33   ..aaaaa..0...1.3  
 0010:  2e 36 2e 31 2e 34 2e 31  2e 34 32 2e 32 2e 32 37   .6.1.4.1.42.2.27  
 0020:  2e 38 2e 35 2e 31 04 00                            .8.5.1..          
502a936b => get_ctrls
ber_scanf fmt ({m) ber:
ber_dump: buf=101fd8f00 ptr=101fd8f3a end=101fd8f59 len=31
 0000:  30 1d 04 19 31 2e 33 2e  36 2e 31 2e 34 2e 31 2e   0...1.3.6.1.4.1.  
 0010:  34 32 2e 32 2e 32 37 2e  38 2e 35 2e 31 04 00      42.2.27.8.5.1..   
ber_scanf fmt (m) ber:
ber_dump: buf=101fd8f00 ptr=101fd8f57 end=101fd8f59 len=2
 0000:  00 00                                              ..                
502a936b => get_ctrls: oid="1.3.6.1.4.1.42.2.27.8.5.1" (noncritical)
502a936b <= get_ctrls: n=1 rc=2 err="passwordPolicyRequest control value not
absent"
502a936b send_ldap_result: conn=1001 op=0 p=3
502a936b send_ldap_response: msgid=1 tag=97 err=2

As an aside, the error text left me scratching my head and reading the source
code to figure out what was meant. Each of the other request control handlers
that doesn't require/allow a control value has a similar message. Could we
change these messages to:

{Warning|Error}: Spurious <control name here> control value found in request.

Comments?