Re: (ITS#5731) Don't rewrite filter when it is undefined

[ando@sys-net.it]

----- kouk@noc.uoa.gr wrote:

> On Thu, 09 Oct 2008 23:45:42 +0300, <ando@sys-net.it> wrote:
> 
> > The bug is confirmed; the proposed fix is incorrect, since it only
> > addresses the case of a(n undefined) simple filter.  A more complete
> fix
> > (see also ITS#5732) is in HEAD, please test.  p.
> 
> OK, I tested it and indeed it doesn't crash anymore. But I have a
> question  
> regarding the fix in HEAD. When an undefined filter is supplied by the
>  
> client, what is the intended behavior? From what I can tell the
> current  
> (HEAD) behavior is that it is ignored (as false?). This is different
> from  
> the previous behavior where, as I remember, an undefined filter error
> was  
> reported to the client.

AFAIK, the correct behavior is to ignore the filter if it is undefined.  Nothing has to be reported to the client.  If it occurred earlier, it was an error.


> Also from my tests with HEAD it seems that when the rwm overlay is
> present  
> the implemented fix's check for an undefined filter will produce a
> filter  
> semantically equivalent to false, "(!(objectClass=*))", which slapd
> will  
> then procede to match against every entry under the base DN. This is 
> 
> different than what happens in HEAD (and in 2.4.11) without the rwm  
> overlay, which is that the entries aren't even considered.

When the filter is undefined, it is ignored.  In fact, if a filter is "(|(cn=*)(foo=bar))" and attribute "foo" does not exist, the filter reduces to "(cn=*)".  However, when the remapped filter needs to be passed to ldap_search() in string form, an undefined filter needs to be rewritten in LDAP form.  I decided to rework it into "(!(objectClass=*))" just because it was easier.  A better solution would probably have been to handle it along the above lines.  Call it laziness, if you like.  Feel free to propose a better solution.  Better if you provide a patch, though :)

p.


Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Fax:     +39 0382 476497
Email:   ando@sys-net.it
-----------------------------------