(ITS#6683) DDS fails with expired branches

[petteri.stenius@ubisecure.com]

Full_Name: 
Version: 2.4.23
OS: Linux
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (195.197.205.34)


Hello,

I have a directory with branches of dynamicObject entries. It looks like if the
entryExpireTimestamp value is the same on objects within a branch then DDS
search for expired objects will only find the top-most object. This results in
remove failing with message

DDS dn="cn=top,cn=root,dc=test" is non-leaf; deferring.


To reproduce

OpenLDAP 2.4.23, Berkeley DB 4.6.21

Use slapadd to prepare directory with following

dn: cn=Root,dc=test
objectClass: top
objectClass: applicationProcess
cn: Root

dn: cn=top,cn=Root,dc=test
objectClass: top
objectClass: device
objectClass: dynamicObject
entryTTL: 60
entryExpireTimestamp: 20101024113626Z
cn: top

dn: cn=leaf1,cn=top,cn=Root,dc=test
objectClass: top
objectClass: device
objectClass: dynamicObject
entryTTL: 60
entryExpireTimestamp: 20101024113626Z
cn: leaf1

dn: cn=leaf2,cn=top,cn=Root,dc=test
objectClass: top
objectClass: device
objectClass: dynamicObject
entryTTL: 60
entryExpireTimestamp: 20101024113626Z
cn: leaf2

dn: cn=leaf3,cn=top,cn=Root,dc=test
objectClass: top
objectClass: device
objectClass: dynamicObject
entryTTL: 60
entryExpireTimestamp: 20101024113626Z
cn: leaf3


Relevant slapd.conf entries

database        bdb
suffix          "cn=Root,dc=test"
rootdn          "cn=Root,dc=test"
rootpw          "password"

overlay         dds
dds-default-ttl 3600
dds-min-ttl     60
dds-interval    60
dds-state       true
index           entryExpireTimestamp eq,pres

access to dn.subtree="cn=Root,dc=test"
        by users write
        by * read


Running "slapd -d 1 -d 256" produces following

put_filter: "(&(objectClass=dynamicObject)(entryExpireTimestamp<=20101025082446Z))"
put_filter: AND
put_filter_list "(objectClass=dynamicObject)(entryExpireTimestamp<=20101025082446Z)"
put_filter: "(objectClass=dynamicObject)"
put_filter: simple
put_simple_filter: "objectClass=dynamicObject"
put_filter: "(entryExpireTimestamp<=20101025082446Z)"
put_filter: simple
put_simple_filter: "entryExpireTimestamp<=20101025082446Z"
ber_scanf fmt ({mm}) ber:
ber_scanf fmt ({mm}) ber:
=> bdb_search
bdb_dn2entry("cn=root,dc=test")
=> bdb_dn2id("cn=root,dc=test")
<= bdb_dn2id: got id=0x1
entry_decode: "cn=Root,dc=test"
<= entry_decode(cn=Root,dc=test)
search_candidates: base="cn=root,dc=test" (0x00000001) scope=2
=> bdb_dn2idl("cn=root,dc=test")
=> bdb_equality_candidates (objectClass)
=> key_read
<= bdb_index_read: failed (-30989)
<= bdb_equality_candidates: id=0, first=0, last=0
=> bdb_equality_candidates (objectClass)
=> key_read
<= bdb_index_read 4 candidates
<= bdb_equality_candidates: id=4, first=2, last=5
=> bdb_inequality_candidates (entryExpireTimestamp)
=> key_read
<= bdb_index_read 1 candidates
=> key_read
<= bdb_index_read: failed (-30989)
<= bdb_inequality_candidates: id=1, first=2, last=2
bdb_search_candidates: id=1 first=2 last=2
entry_decode: "cn=top,cn=Root,dc=test"
<= entry_decode(cn=top,cn=Root,dc=test)
=> bdb_dn2id("cn=top,cn=root,dc=test")
<= bdb_dn2id: got id=0x2
send_ldap_result: conn=-1 op=0 p=0
bdb_dn2entry("cn=top,cn=root,dc=test")
=> bdb_dn2id_children("cn=top,cn=root,dc=test")
<= bdb_dn2id_children("cn=top,cn=root,dc=test"):  (0)
send_ldap_result: conn=-1 op=0 p=0
DDS dn="cn=top,cn=root,dc=test" is non-leaf; deferring.
DDS expired=0


ldapsearch "(entryExpireTimestamp=*)" produces

dn: cn=top,cn=Root,dc=test
entryExpireTimestamp: 20101024113626Z

dn: cn=leaf1,cn=top,cn=Root,dc=test
entryExpireTimestamp: 20101024113626Z

dn: cn=leaf2,cn=top,cn=Root,dc=test
entryExpireTimestamp: 20101024113626Z

dn: cn=leaf3,cn=top,cn=Root,dc=test
entryExpireTimestamp: 20101024113626Z


where ldapsearch "(entryExpireTimestamp<=20101024113626Z)" only finds

dn: cn=top,cn=Root,dc=test
entryExpireTimestamp: 20101024113626Z


If I change all timestamps to distinct values then expiration of complete
branches works as expected.


Thanks,
Petteri