From 59164ecfb6b1ebe46dabb2e1a2b888812248a916 Mon Sep 17 00:00:00 2001
From: Quanah Gibson-Mount <quanah@openldap.org>
Date: Thu, 15 Apr 2010 18:23:25 +0000
Subject: [PATCH] ITS#6480

---
 CHANGES                  |  1 +
 servers/slapd/controls.c | 27 ++++++++++++++++++---------
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/CHANGES b/CHANGES
index c8f633cae6..da0d9ed813 100644
--- a/CHANGES
+++ b/CHANGES
@@ -7,6 +7,7 @@ OpenLDAP 2.4.22 Engineering
 	Fixed libldap GnuTLS serial length (ITS#6460)
 	Fixed slapd certificateListValidate (ITS#6466)
 	Fixed slapd empty URI parsing (ITS#6465)
+	Fixed slapd ignore controls with unrecognized flags (ITS#6480)
 	Fixed slapd REP_ENTRY flag handling (ITS#5340)
 	Fixed slapd sasl auxprop_lookup (ITS#6441)
 	Fixed slapd-bdb contextCSN updates from updatedn (ITS#6469)
diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index fdc888d766..ca7e8b2c73 100644
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -1671,6 +1671,24 @@ static int parseSearchOptions (
 		return LDAP_PROTOCOL_ERROR;
 	}
 
+	if ( search_flags & ~(LDAP_SEARCH_FLAG_DOMAIN_SCOPE) ) {
+		/* Search flags not recognised so far,
+		 * including:
+		 *		LDAP_SEARCH_FLAG_PHANTOM_ROOT
+		 */
+		if ( ctrl->ldctl_iscritical ) {
+			rs->sr_text = "searchOptions contained unrecognized flag";
+			return LDAP_UNWILLING_TO_PERFORM;
+		}
+
+		/* Ignore */
+		Debug( LDAP_DEBUG_TRACE,
+			"searchOptions: conn=%lu unrecognized flag(s) 0x%x (non-critical)\n", 
+			op->o_connid, (unsigned)search_flags, 0 );
+
+		return LDAP_SUCCESS;
+	}
+
 	if ( search_flags & LDAP_SEARCH_FLAG_DOMAIN_SCOPE ) {
 		if ( op->o_domain_scope != SLAP_CONTROL_NONE ) {
 			rs->sr_text = "searchOptions control specified multiple times "
@@ -1683,15 +1701,6 @@ static int parseSearchOptions (
 			: SLAP_CONTROL_NONCRITICAL;
 	}
 
-	if ( search_flags & ~(LDAP_SEARCH_FLAG_DOMAIN_SCOPE) ) {
-		/* Other search flags not recognised so far,
-		 * including:
-		 *		LDAP_SEARCH_FLAG_PHANTOM_ROOM
-		 */
-		rs->sr_text = "searchOptions contained unrecognized flag";
-		return LDAP_UNWILLING_TO_PERFORM;
-	}
-
 	return LDAP_SUCCESS;
 }
 
-- 
2.39.5