CVS log for servers/slapd/back-ldap/search.c

Up to [OpenLDAP] / servers / slapd / back-ldap

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Re-fix ITS#6793 (back-ldap bad free of matchedDN).

Previous fix opened for a ITS#6758-style double free if the
caller was broken.  Using REP_MATCHED_MUSTBEFREED is more robust.

also handle RFC 4526 t-f filters in back-ldap (more about ITS#6814)

handle undefined filters in back-ldap (more about ITS#6814)

handle undefined objectClass values in search filters (ITS#6814)

ITS#5421 drop ldap-int.h

ITS#6793 Fix back-ldap bad free on matchedDN change

Happy New Year

ITS#6758 Reset dangerous REP_ENTRY_* flags.
If SlapReply.sr_un cannot contain an entry but does or soon may
contain another member than sru_search: Ensure nothing will see
leftover REP_ENTRY_* flags and try to clean up the "entry" there.

ITS#6758 Reset some SlapReply flags & data.
Reset data more consistenlty.  When resetting sr_entry after sending
data, reset sr_flag as well.  Reset rs_attrs and Extended Operation
oid/data after setting and sending them.

For ITS#5421: Also LBER_FREE() -> ber_memfree()

For ITS#5421: Remove ldap-int.h dependencies.
LDAP_FREE() -> ber_memfree(), msg->lm_ber -> ldap_get_message_ber(msg).

don't risk leaving around client library error codes

allow to specify a per-database list of attributes that need to be always collected, even if not explicitly requested by clients (addresses ITS#6513)

happy belated New Year

handle ordered values as appropriate (ITS#6516)

use slab allocation

plug leak/logical error (ITS#6326)

silence warnings

More explicit for prev commit

ITS#6003, #5916 fix ldap_back_entry_get_rw, no deref here

More for prev

Fix potential double-free of filter on abandon

ITS#5977 fix typo

fix ITS#5959 fix

Better fix for prev

More for prev commit

ITS#5977 strip duplicates out of sorted attrs

ITS#5959 drop illegal values, only drop attr if it's left empty

more on ITS#5931: handle intermediate responses and support syncrepl also in back-ldap

do not assert when receiving intermediate response (partial fix to ITS#5931)

discard attribute values if attribute name cannot be parsed (ITS#5927)

ITS#5916 - externally callable functions are ldap_pvt, not ldap_int.

Allow alias dereferencing in search C API; use new API in proxy backends (ITS#5916)

Update copyright notices

don't bailout in case of insufficientAccess (ITS#5816)

canonicalize undef objectClass names (much like attributes; ITS#5681)

free filter before overlays' cleanup callback

fix potential leak in previous commit

improve previous commit (ITS#5614)

do not propagate undefined or otherwise broken search filters (ITS#5614)

allow proxies to filter out search references (ITS#5593)

lookup entries as LDAP_REQ_SEARCH (ITS#5513)

Happy New Year (belated)

More for a_numvals

Attribute/Modification value counters

alloc temporaries on slab

further fix ITS#5138 (please review)

ITS#5138 don't scan past the sequence of attributes

add support for session tracking (draft-wahl-ldap-sessio) to proxy backends requests

ITS#5025 clear sr_entry before sending search reference

cleanup after sending entry

fix previous commit (ITS#4861)

check consistency of referrals and result code (ITS#4861)

don't return adminLimitExceeded unless LDAPv3; use largest among candidates timeouts

implement search timeout when the remote server does not respond in the specified timeout

fix entry deallocation

further cleanup

allow forcing abandon of search operations on a connection basis

happy new year

catch double free

more on clarification of special proxy identities and resilience to connection failure

fix ITS#4686 (retry with idassert)

improve timeout support (ITS#4157, ITS#4663); manpage cleanup

back-ldap should only touch the connection timestamp when activity actually occurred (i.e. ldap_result() returned a positive value), otherwise if "the network cable is removed after the connection is established" ldap_result() keeps returning 0 forever...

fix pre-allocated entry/attribute handling

Entry/Attribute struct caching, to minimize malloc fragmentation
Note: this breaks LDAP_COMP_MATCH and SLAP_ZONE_MALLOC. But they
were probably broken already anyway.

give slapd a chance to play callback cleanup handlers when a search operation is abandoned (ITS#4645)

port identity assertion to back-meta; share as much code as possible with back-ldap; misc cleanup

add support for recursive referrals (with simple loop detection) to slapo-chain (ITS#4070); add simple support for returning the error code instead of the original referral (ITS#4570)

cleanup identity assertion; ready for porting to back-meta

rework quarantine locking and so

implement proxy quarantine (ITS#4569)

add cancel strategies (ITS#4560)

fix referrals return for ops other than search (ITS#4557); use slab memory for temporaries in returning referrals

Fix ITS#4450, don't overwrite remote server's rs->sr_text

fix previous commit

make sure rs->sr_err is fine

propagate pretty DN (ITS#4456)

unifdef -DLDAP_NULL_IS_NULL

in abnormal cases, error may be sent twice

cleanup

Happy new year!

fix memory handling

use macros instead of numbers...

use LDAP_SIZELIMIT_EXCEEDED; rework the return values of slap_send_search_entry(); silence a few warnings

check sizelimit in frontend (ITS#4213)

don't care about empty matched/text #ifdef LDAP_NULL_IS_NULL

cleanup

fix dangling resources issue in slapd-ldap; completely rework slapo-chain to fix the resource leak/concurrency issue; add support for multiple well-known URIs to set credentials for, and deal with unknown URIs anonymously; similar reworking and cleanup for slapd-meta

refine previous commit...

fix matched handling of slapd-ldap/slapo-chain (ITS#4176)

backport write operation timeouts from back-meta to back-ldap; minor cleanup & silence warnings

don't leak matchedDN

cleanup states/timeout handling in back-ldap/meta; add connection pooling and defer of pseudoroot bind to back-meta

fix previous commit

prettify matchedDN; return response code

allow undefined attrs to be "proxied" (ITS#3959)

need some minimal timeout otherwise strange issues occur

strip entryDN from search entries; frontend will reattach it :(

set "matched" as appropriate (ITS#3942)

fix referrals handling (needs work)

reverse logic (chasing a dangling pointer...)

fix ITS#3862

assert expects int. (int)<nonnull ptr/long> can be 0. Use assert(arg!=0/NULL).

seems to definitely fix issues related to ITS#3808

more on ITS#3808

fix ITS#3785: do our best to deal with invalid filters...

preemptive time limit check in proxy backends

fix entry DN free

don't bother about slap_dummy_bv

consistently rename function

fix previous commit: don't loop on undefined; return success with no data in case of undefined filter

fix support for absoluteFilters

fix previous commit

honor T-F filters (ITS#3706) and some cleanup

if for any reason ldap_search_ext() fails (e.g. ITS#3706) don't wait for results

Fix typo

Fix prev commit, make sure to only send result once

Fix ITS#3537 (need to repeat this fix for the other operations too.)

Always return SLAPD_ABANDON in response to op->o_abandon being set.

allow stacking of a default chaining control when chasing further referrals; fix referral return memory allocation on direct search

implement hook; cleanup

allow referrals in result (may happen); propagate chaining errors

StartTLS (ITS#3507) + chain overlay fixes and improvements

remove #ifdef's for identity assertion

cleanup; add proxyAuthz capability

Happy New Year!

trim comment

more cleanup

allow undefined schema items to be returned by back-ldap and remapped by the rwm overlay

remove rewrite stuff -- now delegted to rwm overlay

Add a retry for entry_get too. (oops)

Add a retry for failed connections

unifdef -UNEW_LOGGING

add paged results support to back-ldap

slightly rework user/operational attributes handling (including fixing a bug in the logic of the previous change to backend_operational()); cleanup; more improvements to slapo-rwm and back-relay

fix previous fix

rework op/rs structures to deal with opeartional attributes

validate/pretty before normalizing... (ITS#3218)

clear shared connections when ldap_result fails with -1 (typically, remote server is down); fixes ITS#3217

clarify no limits in (internal) searches

Fix entry_get, only check mapped attr if attr was provided

more on identity assertion

Always normalize entries (ITS#3152, ITS#3144)

add idassert code (undocumented yet)

use BER_BVNULL

exploit new frontend API 2 protocol error mapping; use urldesc...

reset SlapReply flags

add "searchFilterAttrDN" rewrite context, and allow filterstring rewrite

move limits evaluation to frontend

fix continuation of ITS#2999

handle filter computed in a more granular way (ITS#2977)

allow search limits based on groups (ITS#2967)

ITS#2888 fix back-ldap to check result of send_search_entry.
Make sure sizelimit errors are propagated.

improve fix to ITS#2923; note that suffix massaging is inherently flawed, because comperisons should always occur on Normalized DN, while massaging can also occur on Pretty DN, but there is no guarantee they have the same length or any length-based comparison can work; so in any case, we should pass the Normalized DN and, if the Pretty DN is present, massage it as well accordingly

fix ITS#2923

Happy new year

Clean up entry initialization

notices and acknowledgements

Clear ocflags

add administrative bind and proxyAuthz control to enable bound operations in distributed directories (need to manually #define LDAP_BACK_PROXY_AUTHZ and patches from ITS#2851 and ITS#2852)

this memory will be freed by free()

notices and acknowledges

Fix segfault if entry_get is called with NULL attribute

remove dnNormalize2
replace calls to dnNormalize2 with calls to dnNormalize

More memory context tweaks

need a second function because of different free() routines

use berval

group rewrite/map stuff in one structure and optimize more function calls

use rewrite info instead of ldapinfo for reusability in back-meta; will change soon

Use individual addAttrDN, compareAttrDN, modifyAttrDN, searchAttrDN contexts
instead of re-using other contexts.

Cleanup previous

(SLAP_NVALUES) attr->a_nvals must not be NULL, set equal to a_vals when
not normalizing.

Fix matchedDn detection

Cleanup ENABLE_REWRITE ifdefs, put into a new ldap_back_dn_massage().
All DN attrs are massaged, whether or not ENABLE_REWRITE is defined.
Use "dnAttr" rewriteContext for Add, Compare, & Modify.
Fixed ldap_back_compare.

map attrs improvement

#ifdef -DSLAP_NVALUES

cleanup

minor fixes: leaks, dangling pointers, cleaner tag skip
for subschemaSubentry; still having problems with group ACLs ...

more args elimination + allow specific messages when mapping client API errors to LDAP_OTHER

normalize values only if required

handle failure or missing attrs

Fix prev commit

Mapping fixes, SLAP_NVALUES fixes

first cut at mapping/rewriting before search (after search it's already handled by ldap_build_entry)

remove more unnecessary args

Fix shared/private binds, fix entry_get malloc

trim unnecessary args

anyone knows a safer way to skip a tag?

of course there's a better way to skip a tag :)

eat undesired values

cleanup and fixes

Fix typos in prev commit

Consolidated slap_callbacks into one function. Removed send_search_result.

Major API change - (SLAP_OP_BLOCKS) All request parameters are
consolidated into the Operation structure. All reply parameters
are consolidated into the new SlapReply structure. Most operations
now have identical call signatures... Changes are not #ifdef'd,
revert to -r NO_SLAP_OP_BLOCKS if necessary to back out.

Deleted BackendInfo->bi_acl_attribute, bi_acl_group.
Replaced with bi_entry_get_rw.
Implemented for back-bdb, back-ldbm, back-ldap.

SLAP_NVALUES - quick hack, just set a->a_nvals = a->a_vals. will need to
fix this if ACLs are expected to work on the local slapd.

fix ITS#2362 and other leaks/unhandled massaged DN memory

improved filter mapping/rewrite; improved result rewriting; improved attribute/objectclass mapping configuration

Fix do/don't send result logic

Added passwd_exop, added matchedDN rewrite for results.

Use extended async APIs to allow direct parsing of results. Otherwise
they will be interleaved in LDAP*. Avoid setting any options on the handle.

Implemented connection pooling. Requires libldap_r to allow multiple threads
to access the same LDAP* handle.

Revert previous, wasn't broken.

Fix uninit'd timeout value

clean up mapping api

fix objectclass mapping (to nothing)

Happy new year

improve limits handling and consistency; return "Admin limit exceeded" instead of "Unwilling to perform"

improve error messages

added referral support to back-{ldap,meta}; need to allow send_serch_reference() handle NULL entry pointer

add server side controls to back-ldap and back-meta

better error handling when returning results

same as for back-meta

operationsError != Internal Error
hence, s/LDAP_OPERATIONS_ERROR/LDAP_OTHER/

Coverted LDAP_LOG macro to use subsystem ID int values instead of string values

Use specific msg id instead of ANY to retrieve search results

broken berval after successful rewrite

massage dn-valued attributes also when compiled without --enable-rewrite

use BerVarray for suffix_massaging stuff

honor limits if below soft limit

ITS#1733 eliminate o_abandonmutex

Silence a warning about ldap_debug

Renamed BVarray to BerVarray. Moved slapd:bvarray_{add,free} to
liblber:ber_bvarray_{add,free}.

Modify performance patch from Gertjan van Wingerde <gwingerde@home.nl>

some memory handling cleanup: check that memory is freed by who allocated it, or at least put a FIXME where not

Use 'm' ber_scanf format where convenient

more cleanup

Update copyright statements

misc fix/improvements

fix rewrite iteration

struct berval fixes, fix memory leak in ldap_send_entry

trivial fixes

Changed AttributeName back into an array instead of a linked list.
Fixed bug in do_search eating up controls.

minor fixes

Change struct berval ** to BVarray

Changed search attrs from struct berval ** to AttributeName *

fix rewrite stuff

Added dnPretty2/dnNormalize2 using preallocated destination berval

More struct beral conversion

some char* to berval fixes

Changed get_limits to struct berval*

Fix attrs handling

Changed search attrs to struct berval **.
Use typedefs for all backend functions, to minimize work in future API
updates. (back-*/external.h will never need updating in the future.)

More struct berval DNs

Changed sai_dn, sai_ndn to struct berval. (Affects op->o_dn,o_ndn,
conn->c_dn,c_ndn, Access->a_dn_pat)

Changed AttributeType.sat_cname from char * to struct berval.
(will fix up back-bdb next.)

Moved AttributeDescription caching into main code:
   Changed AttributeDescription.{ad_cname,ad_lang} to struct berval everywhere
   Deleted ad_free() everywhere
   Added ad_mutex to init.c

The AttributeDescriptions are in a linked list hanging off of the
corresponding AttributeType.

use slap_str2undef_ad for unknown attributes

add limits stuff to back-ldap

semicolon after colon in goto labels

added new log; minor cleanup of rewrite stuff

This is the commit of:
  - librewrite, for string rewriting; it may be used in back-ldap
    by configuring with '--enable-rewrite'. It must be used in
    back-meta. There's a text file, 'libraries/librewrite/RATIONALE',
    that explains the usage and the features. More comprehensive
    documentation will follow.
  - enhancements of back-ldap (ITS#989,ITS#998,ITS#1002,ITS#1054 and ITS#1137)
    including dn rewriting, a fix to group acl matching and so
  - back-meta: a new backend that proxies a set of remote servers
    by spawning queries. It uses portions of back-ldap and the rewrite
    capabilities of librewrite. It can be compiled by configuring
    with `--enable-ldap --enable-rewrite --enable-meta'.
    There's a text file, 'servers/slapd/back-meta/Documentation', that
    describes the main features and config statements.

Note: someone (Kurt?) should run 'autoconf' and commit 'configure' as
my autoconf version must be different: my configures contain a number
of differences and I didn't feel comfortable in adding them :)

bug fix

attribute & objectclass mapping rules

Pierangelo Masarati's bugfixes and enhancements for suffix-massaging.
See the Changes file for detailed description.

Mark as "altered version"

ITS#919: fix str2ad initialization bug

Fix: remap API error codes into protocol error codes before sending
back to client.

Remove lint

unifdef -DSLAPD_SCHEMA_NOT_COMPAT -USLAPD_SCHEMA_COMPAT

Fix memory leak in new schema code.

Update to work with schemas (SLAPD_SCHEMA_NOT_COMPAT=1)

const'ification

In preparation for adding dn_rewrite()...
s/dn_normalize/dn_validate/
s/dn_normalize_case/dn_normalize/

Added mixed-case as well as up-cased DN argument. The behavior of back-bdb2
and back-ldbm are preserved, they only use the up-cased DNs. back-passwd
uses the mixed-case DN. All others are using mixed-case DN, may need more
fixing.

Add OpenLDAP RCSid to *.[ch] in clients, libraries, and servers.
Replace old Id as needed (back-tcl).
Leave updating of contribWare to contributors (for now).

Fix extraneous call to ldap_msgfree.

Cleanup:
Fix printf formats, remove unused variables, add missing prototypes in slapd,
add static/const, add some return types or change to void return type.

Fix unportable code. Thanks, Hallvard.

Add support for LDAP_ALL_OPERATIONAL_ATTRIBUTES ("+") (based on
LDAPext discussions).
Add attrs and attrsonly support to monitor/config info.
Add rdn attributes to schema/monitor/config.
Add extensibleObject objectclass to schema/monitor/config.
Add top objectclass to rootdse/monitor/config.
Remove opattrs option from send_search_entry().

Add limited LDAP_INVALID_DN_SYNTAX support.  dn_normalize{,_case}() now returns
NULL does not meet basic syntax rules.

Import experimental referral implementation from OPENLDAP_DEVEL_REFERRALS.
Includes support for update referral for each replicated backend.
	Reworked replication test to use update referral.
Includes major rewrite of response encoding codes (result.c).
Includes reworked alias support and eliminates old suffix alias codes
(can be emulated using named alias).
Includes (untested) support for the Manage DSA IT control.
Works in LDAPv2 world.  Still testing in LDAPv3 world.
Added default referral (test009) test.

Add support for unsolicited notifications.

s/LDAP_OPT_MATCH_STRING/LDAP_OPT_MATCHED_DN/

Added include <ac/time.h> needed for struct timeval...

For ITS#157: Added LDAP backend for slapd, which also required adding
LDAP_OPT_MATCH_STRING to ldap.h and libldap/options.c.

Fix transposed send_search_entry args.
Toy with back-passwd/search scopes.

Make other backends (excepting BDB2) compile.
Integration of BDB2 changes will be deferred until after
LDBM work is completed.

Add additional args to send_ldap_result calls.

LDAPv3 Referrals (using old style referral entries) initial commit.
Have not completed work on backends other than LDBM.
All send_() routines have new parameters (which will likely change
some more to support responses with controls).
slapd/back-ldbm only compiles.  NOT TESTED.  This is a work in progress.

Update copyrights for year 2002

fixes ITS#1367 for REL_ENG

Mark as "altered version" per original copyright notice

Import latest back-ldap from devel

Merge latest devel codes into releng 2 branch.
Remove back-perl, back-sql, back-tcl from branch as they have yet
to be updated.
Additional changes are needed prior to release of alpha4.

Merge in all devel changes since 2.0-alpha2.
Move OPENLDAP_REL_ENG_2_MP forward.

ITS#2363 fix from HEAD

First round of imports from HEAD

Search limit updates and other misc cleanup

Misc changes from HEAD

Add search continuation support

Sync with HEAD

Sync with HEAD

Sync with HEAD

s/LDAP_OPERATIONS_ERROR/LDAP_OTHER/

mostly new logging

Suck in latest changes from HEAD

Suck in HEAD changes since 2.1alpha

import ITS#3862 fix

Cleanup prev commit

ITS#3537 - import fix from HEAD

Import entry_get fix from HEAD

Happy new year!

misc back-ldap/back-meta memory and mapping fixes

ITS#3172 connection retry from HEAD

fix previous fix

import fix to ITS#3217 (cached connections failover) from HEAD

validate/pretty before normalizing... (ITS#3218)

Changes from HEAD, including
+       Fixed back-bdb ignore deadlock bug (ITS#3188)
+       Fixed back-bdb pagedResults no end cookie bug (ITS#3161)
+       Fixed back-bdb pagedResults clear controls bug (ITS#3182)
+       Fixed back-bdb pagedResults ignore control bug
+       Fixed slapd internal search limit bugs (ITS#3183)
+       Added slapd -l USER/DAEMON options (ITS#3187)
+       Build environments
+               Fixed back-sql trace build

Misc fixes including:
+       Fixed slapd set acl recursion (ITS#3140)
+       Fixed slapd entry2mods normalization bug (ITS#3144,3152)
+       Fixed back-ldap normalization bug
+       Fixed pcache cache_entries init bug (ITS#3150)
+       Fixed pcache consistency_check bug (ITS#3151)

Sync with HEAD

Suck in changes from HEAD (CHANGES needs ITS #s)
+       Fixed slapd syncrepl replication bugs
+       Fixed slapd slurpd update bugs
+       Fixed slapd inappropriate bind error disclosure bugs
+       Fixed slapd sun_path portability bug
+       Fixed slapd passwd referral memory leak
+       Fixed slapd sasl userdb checkpass bug
+       Added slapd Delivery Method syntax validation
+       Updated slapd overlay framework
+       Updated back-ldap backend
+       Updated back-meta backend

Sync with HEAD

Sync with HEAD as of 14-March-2004

refine fix to ITS#2999

Sync with HEAD

Sync with HEAD

Happy new year

Sync with HEAD

Sync with HEAD

Last(?) set of changes before 2.2beta

import fix to ITS#5513

Happy new year! (belated)

ITS#5138 from HEAD - controls, slab allocation

ITS#5025 from HEAD

fix previous commit (ITS#4861)

import fix to ITS#4861

import back-ldap/back-meta improvements from HEAD

line up with HEAD (ready for release)

import selected fixes/improvements to proxy backends from HEAD:

        Fixed slapd-ldap/meta privileged conn caching (ITS#4547)
        Fixed slapd-ldap chase-referrals switch (ITS#4557)
        Fixed slapd-ldap bind behavior when idassert is always used (ITS#4781)
        Fixed slapd-ldap response handling bugs (ITS#4782)
        Fixed slapd-ldap/meta privileged connections handling (ITS#4791)
        Fixed slapd-meta retrying (ITS#4594, 4762)
        Fixed slapo-chain referral DN use (ITS#4776)

More for ITS#4638, double-free fix from HEAD

happy new year

fix ITS#4686 (retry with idassert)

ITS#4450 fix from HEAD

import fix to ITS#4474

import pretty DN propagation fix (ITS#4456)

Changes suggested by Ando.

import selected fixes/enhancements from HEAD (ITS#4387, partial ITS#4390)

Misc fixes from HEAD

Happy new year!

ITS#4115 fixes for back-meta/ldap

Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD
Changes needs updating for release...

Sync with HEAD

Sync with HEAD

Sync with HEAD (need to update CHANGES)

Sync with HEAD
ready for 2.3.6?

Sync with HEAD

Sync with HEAD

Sync with HEAD

sync with HEAD

Merge in recent changes to HEAD

Sync with HEAD

Merge from HEAD

Sync with HEAD

Sync with HEAD
ready for 1alpha release

Sync with HEAD

Sync with HEAD

Sync with HEAD

Sync with HEAD

Re-fix ITS#6793 (back-ldap bad free of matchedDN).

ITS#6814

ITS#6758

More for ITS#5421

ITS#6793

ITS#6625,ITS#5421

Happy New Year!

don't risk leaving around client library error codes; try to return additional information

ITS#6516

use slab allocation

happy belated new year

ITS#6326

silence warnings

ITS#5916,ITS#6003

ITS#5977,ITS#5959 re-fix

More for ITS#5959

More for ITS#5927, ITS#5931

Fix ITS#5931 crasher bits

ITS#5916

Update copyright for next release

ITS#5816

ITS#5681

ITS#5614

ITS#5593

import fix to ITS#5513

Happy new year! (belated)

ITS#5153 from HEAD - sorted values

ITS#5138 from HEAD, control parsing, slab allocation

Sync with HEAD for OL 2.4.5

Quick merge: everything from HEAD

Sync with HEAD

Sync with HEAD

ITS#4450 fix from head

Sync with HEAD