ITS#6480

diff --git a/CHANGES b/CHANGES
index c8f633cae6d62f3f8d1ae16cc430b3ee40a406ea..da0d9ed81321ddc715fcae4635caa492f7d67cdc 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,7 @@ OpenLDAP 2.4.22 Engineering
        Fixed libldap GnuTLS serial length (ITS#6460)
        Fixed slapd certificateListValidate (ITS#6466)
        Fixed slapd empty URI parsing (ITS#6465)
+       Fixed slapd ignore controls with unrecognized flags (ITS#6480)
        Fixed slapd REP_ENTRY flag handling (ITS#5340)
        Fixed slapd sasl auxprop_lookup (ITS#6441)
        Fixed slapd-bdb contextCSN updates from updatedn (ITS#6469)

diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index fdc888d766b6f91c6a0a6c0571c62151914dd098..ca7e8b2c7379e9212ea6aa0633cb525877b44cc0 100644 (file)
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -1671,6 +1671,24 @@ static int parseSearchOptions (
                return LDAP_PROTOCOL_ERROR;
        }
 
+       if ( search_flags & ~(LDAP_SEARCH_FLAG_DOMAIN_SCOPE) ) {
+               /* Search flags not recognised so far,
+                * including:
+                *              LDAP_SEARCH_FLAG_PHANTOM_ROOT
+                */
+               if ( ctrl->ldctl_iscritical ) {
+                       rs->sr_text = "searchOptions contained unrecognized flag";
+                       return LDAP_UNWILLING_TO_PERFORM;
+               }
+
+               /* Ignore */
+               Debug( LDAP_DEBUG_TRACE,
+                       "searchOptions: conn=%lu unrecognized flag(s) 0x%x (non-critical)\n", 
+                       op->o_connid, (unsigned)search_flags, 0 );
+
+               return LDAP_SUCCESS;
+       }
+
        if ( search_flags & LDAP_SEARCH_FLAG_DOMAIN_SCOPE ) {
                if ( op->o_domain_scope != SLAP_CONTROL_NONE ) {
                        rs->sr_text = "searchOptions control specified multiple times "
@@ -1683,15 +1701,6 @@ static int parseSearchOptions (
                        : SLAP_CONTROL_NONCRITICAL;
        }
 
-       if ( search_flags & ~(LDAP_SEARCH_FLAG_DOMAIN_SCOPE) ) {
-               /* Other search flags not recognised so far,
-                * including:
-                *              LDAP_SEARCH_FLAG_PHANTOM_ROOM
-                */
-               rs->sr_text = "searchOptions contained unrecognized flag";
-               return LDAP_UNWILLING_TO_PERFORM;
-       }
-
        return LDAP_SUCCESS;
 }