Changeset 745 for trunk/server/source4/lib/ldb/common

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/lib/ldb/common/attrib_handlers.c (modified) (11 diffs)
• source4/lib/ldb/common/ldb.c (modified) (37 diffs)
• source4/lib/ldb/common/ldb_attributes.c (modified) (8 diffs)
• source4/lib/ldb/common/ldb_controls.c (modified) (7 diffs)
• source4/lib/ldb/common/ldb_dn.c (modified) (77 diffs)
• source4/lib/ldb/common/ldb_ldif.c (modified) (8 diffs)
• source4/lib/ldb/common/ldb_match.c (modified) (18 diffs)
• source4/lib/ldb/common/ldb_modules.c (modified) (26 diffs)
• source4/lib/ldb/common/ldb_msg.c (modified) (34 diffs)
• source4/lib/ldb/common/ldb_options.c (copied) (copied from vendor/current/source4/lib/ldb/common/ldb_options.c )
• source4/lib/ldb/common/ldb_parse.c (modified) (18 diffs)
• source4/lib/ldb/common/ldb_utf8.c (modified) (4 diffs)

trunk/server/source4/lib/ldb/common/attrib_handlers.c

@@ -3 +3 @@
 
    Copyright (C) Andrew Tridgell  2005
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006-2009
 
      ** NOTE! The following LGPL license applies to the ldb
@@ -55 +56 @@
 {
         char *s, *t;
-        int l;
+        size_t l;
 
         if (!in || !out || !(in->data)) {
@@ -100 +101 @@
 }
 
+/* length limited conversion of a ldb_val to a int32_t */
+static int val_to_int64(const struct ldb_val *in, int64_t *v)
+{
+        char *end;
+        char buf[64];
+
+        /* make sure we don't read past the end of the data */
+        if (in->length > sizeof(buf)-1) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        strncpy(buf, (char *)in->data, in->length);
+        buf[in->length] = 0;
+
+        /* We've to use "strtoll" here to have the intended overflows.
+         * Otherwise we may get "LONG_MAX" and the conversion is wrong. */
+        *v = (int64_t) strtoll(buf, &end, 0);
+        if (*end != 0) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        return LDB_SUCCESS;
+}
 
 
@@ -109 +131 @@
                                     const struct ldb_val *in, struct ldb_val *out)
 {
-        char *end;
-        long long i = strtoll((char *)in->data, &end, 0);
-        if (*end != 0) {
-                return -1;
-        }
-        out->data = (uint8_t *)talloc_asprintf(mem_ctx, "%lld", i);
+        int64_t i;
+        int ret;
+
+        ret = val_to_int64(in, &i);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        out->data = (uint8_t *) talloc_asprintf(mem_ctx, "%lld", (long long)i);
         if (out->data == NULL) {
-                return -1;
+                ldb_oom(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
         }
         out->length = strlen((char *)out->data);
@@ -128 +153 @@
                                   const struct ldb_val *v1, const struct ldb_val *v2)
 {
-        return strtoll((char *)v1->data, NULL, 0) - strtoll((char *)v2->data, NULL, 0);
+        int64_t i1=0, i2=0;
+        val_to_int64(v1, &i1);
+        val_to_int64(v2, &i2);
+        if (i1 == i2) return 0;
+        return i1 > i2? 1 : -1;
 }
 
@@ -241 +270 @@
                 talloc_free(b1);
                 talloc_free(b2);
-                if (memcmp(s1, s2, MIN(n1, n2)) == 0) {
+                ret = memcmp(s1, s2, MIN(n1, n2));
+                if (ret == 0) {
                         if (n1 == n2) return 0;
                         if (n1 > n2) {
@@ -249 +279 @@
                         }
                 }
+                return ret;
         }
 
@@ -338 +369 @@
                                   const struct ldb_val *v1, const struct ldb_val *v2)
 {
-        time_t t1, t2;
-        t1 = ldb_string_to_time((char *)v1->data);
-        t2 = ldb_string_to_time((char *)v2->data);
-        return (int)t2 - (int)t1;
+        time_t t1=0, t2=0;
+        ldb_val_to_time(v1, &t1);
+        ldb_val_to_time(v2, &t2);
+        if (t1 == t2) return 0;
+        return t1 > t2? 1 : -1;
 }
 
@@ -350 +382 @@
                                     const struct ldb_val *in, struct ldb_val *out)
 {
-        time_t t = ldb_string_to_time((char *)in->data);
+        time_t t;
+        int ret;
+        ret = ldb_val_to_time(in, &t);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
         out->data = (uint8_t *)ldb_timestring(mem_ctx, t);
         if (out->data == NULL) {
-                return -1;
+                ldb_oom(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
         }
         out->length = strlen((char *)out->data);
@@ -421 +459 @@
                                                             const char *syntax)
 {
-        int i;
+        unsigned int i;
         unsigned num_handlers = sizeof(ldb_standard_syntaxes)/sizeof(ldb_standard_syntaxes[0]);
         /* TODO: should be replaced with a binary search */
@@ -431 +469 @@
         return NULL;
 }
+
+int ldb_any_comparison(struct ldb_context *ldb, void *mem_ctx, 
+                       ldb_attr_handler_t canonicalise_fn, 
+                       const struct ldb_val *v1,
+                       const struct ldb_val *v2)
+{
+        int ret, ret1, ret2;
+        struct ldb_val v1_canon, v2_canon;
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+        /* I could try and bail if tmp_ctx was NULL, but what return
+         * value would I use?
+         *
+         * It seems easier to continue on the NULL context 
+         */
+        ret1 = canonicalise_fn(ldb, tmp_ctx, v1, &v1_canon);
+        ret2 = canonicalise_fn(ldb, tmp_ctx, v2, &v2_canon);
+
+        if (ret1 == LDB_SUCCESS && ret2 == LDB_SUCCESS) {
+                ret = ldb_comparison_binary(ldb, mem_ctx, &v1_canon, &v2_canon);
+        } else {
+                ret = ldb_comparison_binary(ldb, mem_ctx, v1, v2);
+        }
+        talloc_free(tmp_ctx);
+        return ret;
+}

trunk/server/source4/lib/ldb/common/ldb.c

@@ -35 +35 @@
 #define TEVENT_DEPRECATED 1
 #include "ldb_private.h"
+#include "ldb.h"
 
 static int ldb_context_destructor(void *ptr)
@@ -92 +93 @@
         struct ldb_context *ldb;
         int ret;
+        const char *modules_path = getenv("LDB_MODULES_PATH");
+
+        if (modules_path == NULL) {
+                modules_path = LDB_MODULESDIR;
+        }
+
+        ret = ldb_modules_load(modules_path, LDB_VERSION);
+        if (ret != LDB_SUCCESS) {
+                return NULL;
+        }
 
         ldb = talloc_zero(mem_ctx, struct ldb_context);
-        /* FIXME: Hack a new event context so that CMD line utilities work
-         * until we have them all converted */
+        /* A new event context so that callers who don't want ldb
+         * operating on thier global event context can work without
+         * having to provide their own private one explicitly */
         if (ev_ctx == NULL) {
-                ev_ctx = tevent_context_init(talloc_autofree_context());
+                ev_ctx = tevent_context_init(ldb);
                 tevent_set_debug(ev_ctx, ldb_tevent_debug, ldb);
                 tevent_loop_allow_nesting(ev_ctx);
@@ -103 +115 @@
 
         ret = ldb_setup_wellknown_attributes(ldb);
-        if (ret != 0) {
+        if (ret != LDB_SUCCESS) {
                 talloc_free(ldb);
                 return NULL;
@@ -218 +230 @@
 {
         int ret;
-        const char *url2;
+        char *url2;
         /* We seem to need to do this here, or else some utilities don't
          * get ldb backends */
@@ -229 +241 @@
                 return LDB_ERR_OPERATIONS_ERROR;
         }
-        ret = ldb_set_opaque(ldb, "ldb_url", talloc_strdup(ldb, url2));
+        ret = ldb_set_opaque(ldb, "ldb_url", url2);
         if (ret != LDB_SUCCESS) {
                 return ret;
         }
 
-        ret = ldb_connect_backend(ldb, url, options, &ldb->modules);
+        ret = ldb_module_connect_backend(ldb, url, options, &ldb->modules);
         if (ret != LDB_SUCCESS) {
                 return ret;
@@ -286 +298 @@
 }
 
+
+
+/*
+  set an ldb error based on file:line
+*/
+int ldb_error_at(struct ldb_context *ldb, int ecode,
+                 const char *reason, const char *file, int line)
+{
+        if (reason == NULL) {
+                reason = ldb_strerror(ecode);
+        }
+        ldb_asprintf_errstring(ldb, "%s at %s:%d", reason, file, line);
+        return ecode;
+}
+
+
 #define FIRST_OP_NOERR(ldb, op) do { \
         module = ldb->modules;                                  \
         while (module && module->ops->op == NULL) module = module->next; \
+        if ((ldb->flags & LDB_FLG_ENABLE_TRACING) && module) { \
+                ldb_debug(ldb, LDB_DEBUG_TRACE, "ldb_trace_request: (%s)->" #op, \
+                          module->ops->name);                           \
+        }                                                               \
 } while (0)
 
@@ -336 +368 @@
                 }
         }
+        if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                ldb_debug(module->ldb, LDB_DEBUG_TRACE, "start ldb transaction error: %s", 
+                          ldb_errstring(module->ldb));                          
+        }
         return status;
 }
@@ -375 +411 @@
                 /* if a module fails the prepare then we need
                    to call the end transaction for everyone */
-                FIRST_OP(ldb, end_transaction);
-                module->ops->end_transaction(module);
+                FIRST_OP(ldb, del_transaction);
+                module->ops->del_transaction(module);
                 if (ldb->err_string == NULL) {
                         /* no error string was setup by the backend */
@@ -383 +419 @@
                                                ldb_strerror(status),
                                                status);
+                }
+                if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                        ldb_debug(module->ldb, LDB_DEBUG_TRACE, "prepare commit transaction error: %s", 
+                                  ldb_errstring(module->ldb));                          
                 }
         }
@@ -433 +473 @@
                                 status);
                 }
+                if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                        ldb_debug(module->ldb, LDB_DEBUG_TRACE, "commit ldb transaction error: %s", 
+                                  ldb_errstring(module->ldb));                          
+                }
                 /* cancel the transaction */
                 FIRST_OP(ldb, del_transaction);
@@ -478 +522 @@
                                 status);
                 }
+                if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                        ldb_debug(module->ldb, LDB_DEBUG_TRACE, "cancel ldb transaction error: %s", 
+                                  ldb_errstring(module->ldb));                          
+                }
         }
         return status;
 }
+
+/*
+  cancel a transaction with no error if no transaction is pending
+  used when we fork() to clear any parent transactions
+*/
+int ldb_transaction_cancel_noerr(struct ldb_context *ldb)
+{
+        if (ldb->transaction_active > 0) {
+                return ldb_transaction_cancel(ldb);
+        }
+        return LDB_SUCCESS;
+}
+
 
 /* autostarts a transacion if none active */
@@ -633 +694 @@
 {
         TALLOC_CTX *tmp_ctx = talloc_new(req);
-        int i;
+        unsigned int i;
 
         switch (req->operation) {
@@ -706 +767 @@
         } else {
                 for (i=0; req->controls && req->controls[i]; i++) {
-                        ldb_debug_add(ldb, " control: %s  crit:%u  data:%s\n", 
-                                      req->controls[i]->oid, 
-                                      req->controls[i]->critical, 
-                                      req->controls[i]->data?"yes":"no");
+                        if (req->controls[i]->oid) {
+                                ldb_debug_add(ldb, " control: %s  crit:%u  data:%s\n",
+                                              req->controls[i]->oid,
+                                              req->controls[i]->critical,
+                                              req->controls[i]->data?"yes":"no");
+                        }
                 }
         }
@@ -716 +779 @@
 
         talloc_free(tmp_ctx);
+}
+
+/*
+  check that the element flags don't have any internal bits set
+ */
+static int ldb_msg_check_element_flags(struct ldb_context *ldb,
+                                       const struct ldb_message *message)
+{
+        unsigned i;
+        for (i=0; i<message->num_elements; i++) {
+                if (message->elements[i].flags & LDB_FLAG_INTERNAL_MASK) {
+                        ldb_asprintf_errstring(ldb, "Invalid element flags 0x%08x on element %s in %s\n",
+                                               message->elements[i].flags, message->elements[i].name,
+                                               ldb_dn_get_linearized(message->dn));
+                        return LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION;
+                }
+        }
+        return LDB_SUCCESS;
 }
 
@@ -743 +824 @@
         switch (req->operation) {
         case LDB_SEARCH:
+                /* due to "ldb_build_search_req" base DN always != NULL */
+                if (!ldb_dn_validate(req->op.search.base)) {
+                        ldb_asprintf_errstring(ldb, "ldb_search: invalid basedn '%s'",
+                                               ldb_dn_get_linearized(req->op.search.base));
+                        return LDB_ERR_INVALID_DN_SYNTAX;
+                }
                 FIRST_OP(ldb, search);
                 ret = module->ops->search(module, req);
                 break;
         case LDB_ADD:
+                if (!ldb_dn_validate(req->op.add.message->dn)) {
+                        ldb_asprintf_errstring(ldb, "ldb_add: invalid dn '%s'",
+                                               ldb_dn_get_linearized(req->op.add.message->dn));
+                        return LDB_ERR_INVALID_DN_SYNTAX;
+                }
+                /*
+                 * we have to normalize here, as so many places
+                 * in modules and backends assume we don't have two
+                 * elements with the same name
+                 */
+                ret = ldb_msg_normalize(ldb, req, req->op.add.message,
+                                        discard_const(&req->op.add.message));
+                if (ret != LDB_SUCCESS) {
+                        ldb_oom(ldb);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
                 FIRST_OP(ldb, add);
+                ret = ldb_msg_check_element_flags(ldb, req->op.add.message);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
                 ret = module->ops->add(module, req);
                 break;
         case LDB_MODIFY:
+                if (!ldb_dn_validate(req->op.mod.message->dn)) {
+                        ldb_asprintf_errstring(ldb, "ldb_modify: invalid dn '%s'",
+                                               ldb_dn_get_linearized(req->op.mod.message->dn));
+                        return LDB_ERR_INVALID_DN_SYNTAX;
+                }
                 FIRST_OP(ldb, modify);
+                ret = ldb_msg_check_element_flags(ldb, req->op.mod.message);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
                 ret = module->ops->modify(module, req);
                 break;
         case LDB_DELETE:
+                if (!ldb_dn_validate(req->op.del.dn)) {
+                        ldb_asprintf_errstring(ldb, "ldb_delete: invalid dn '%s'",
+                                               ldb_dn_get_linearized(req->op.del.dn));
+                        return LDB_ERR_INVALID_DN_SYNTAX;
+                }
                 FIRST_OP(ldb, del);
                 ret = module->ops->del(module, req);
                 break;
         case LDB_RENAME:
+                if (!ldb_dn_validate(req->op.rename.olddn)) {
+                        ldb_asprintf_errstring(ldb, "ldb_rename: invalid olddn '%s'",
+                                               ldb_dn_get_linearized(req->op.rename.olddn));
+                        return LDB_ERR_INVALID_DN_SYNTAX;
+                }
+                if (!ldb_dn_validate(req->op.rename.newdn)) {
+                        ldb_asprintf_errstring(ldb, "ldb_rename: invalid newdn '%s'",
+                                               ldb_dn_get_linearized(req->op.rename.newdn));
+                        return LDB_ERR_INVALID_DN_SYNTAX;
+                }
                 FIRST_OP(ldb, rename);
                 ret = module->ops->rename(module, req);
@@ -794 +925 @@
 {
         struct ldb_result *res;
-        int n;
+        unsigned int n;
 
         res = talloc_get_type(req->context, struct ldb_result);
@@ -852 +983 @@
 }
 
-int ldb_op_default_callback(struct ldb_request *req, struct ldb_reply *ares)
-{
+int ldb_modify_default_callback(struct ldb_request *req, struct ldb_reply *ares)
+{
+        struct ldb_result *res;
+        unsigned int n;
         int ret;
+
+        res = talloc_get_type(req->context, struct ldb_result);
 
         if (!ares) {
@@ -866 +1001 @@
         }
 
+        switch (ares->type) {
+        case LDB_REPLY_REFERRAL:
+                if (res->refs) {
+                        for (n = 0; res->refs[n]; n++) /*noop*/ ;
+                } else {
+                        n = 0;
+                }
+
+                res->refs = talloc_realloc(res, res->refs, char *, n + 2);
+                if (! res->refs) {
+                        return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
+                }
+
+                res->refs[n] = talloc_move(res->refs, &ares->referral);
+                res->refs[n + 1] = NULL;
+                break;
+
+        case LDB_REPLY_DONE:
+                talloc_free(ares);
+                return ldb_request_done(req, LDB_SUCCESS);
+        default:
+                talloc_free(ares);
+                ldb_set_errstring(req->handle->ldb, "Invalid reply type!");
+                return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
+        }
+
+        talloc_free(ares);
+        return ldb_request_done(req, LDB_SUCCESS);
+}
+
+int ldb_op_default_callback(struct ldb_request *req, struct ldb_reply *ares)
+{
+        int ret;
+
+        if (!ares) {
+                return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
+        }
+
+        if (ares->error != LDB_SUCCESS) {
+                ret = ares->error;
+                talloc_free(ares);
+                return ldb_request_done(req, ret);
+        }
+
         if (ares->type != LDB_REPLY_DONE) {
                 talloc_free(ares);
@@ -878 +1057 @@
 int ldb_build_search_req_ex(struct ldb_request **ret_req,
                         struct ldb_context *ldb,
-                        void *mem_ctx,
+                        TALLOC_CTX *mem_ctx,
                         struct ldb_dn *base,
                         enum ldb_scope scope,
@@ -928 +1107 @@
         if (parent) {
                 req->handle->nesting++;
+                req->handle->parent = parent;
+                req->handle->flags = parent->handle->flags;
         }
 
@@ -936 +1117 @@
 int ldb_build_search_req(struct ldb_request **ret_req,
                         struct ldb_context *ldb,
-                        void *mem_ctx,
+                        TALLOC_CTX *mem_ctx,
                         struct ldb_dn *base,
                         enum ldb_scope scope,
@@ -966 +1147 @@
 int ldb_build_add_req(struct ldb_request **ret_req,
                         struct ldb_context *ldb,
-                        void *mem_ctx,
+                        TALLOC_CTX *mem_ctx,
                         const struct ldb_message *message,
                         struct ldb_control **controls,
@@ -999 +1180 @@
         if (parent) {
                 req->handle->nesting++;
+                req->handle->parent = parent;
+                req->handle->flags = parent->handle->flags;
         }
 
@@ -1008 +1191 @@
 int ldb_build_mod_req(struct ldb_request **ret_req,
                         struct ldb_context *ldb,
-                        void *mem_ctx,
+                        TALLOC_CTX *mem_ctx,
                         const struct ldb_message *message,
                         struct ldb_control **controls,
@@ -1041 +1224 @@
         if (parent) {
                 req->handle->nesting++;
+                req->handle->parent = parent;
+                req->handle->flags = parent->handle->flags;
         }
 
@@ -1050 +1235 @@
 int ldb_build_del_req(struct ldb_request **ret_req,
                         struct ldb_context *ldb,
-                        void *mem_ctx,
+                        TALLOC_CTX *mem_ctx,
                         struct ldb_dn *dn,
                         struct ldb_control **controls,
@@ -1083 +1268 @@
         if (parent) {
                 req->handle->nesting++;
+                req->handle->parent = parent;
+                req->handle->flags = parent->handle->flags;
         }
 
@@ -1092 +1279 @@
 int ldb_build_rename_req(struct ldb_request **ret_req,
                         struct ldb_context *ldb,
-                        void *mem_ctx,
+                        TALLOC_CTX *mem_ctx,
                         struct ldb_dn *olddn,
                         struct ldb_dn *newdn,
@@ -1127 +1314 @@
         if (parent) {
                 req->handle->nesting++;
+                req->handle->parent = parent;
+                req->handle->flags = parent->handle->flags;
         }
 
@@ -1165 +1354 @@
 int ldb_build_extended_req(struct ldb_request **ret_req,
                            struct ldb_context *ldb,
-                           void *mem_ctx,
+                           TALLOC_CTX *mem_ctx,
                            const char *oid,
                            void *data,
@@ -1200 +1389 @@
         if (parent) {
                 req->handle->nesting++;
+                req->handle->parent = parent;
+                req->handle->flags = parent->handle->flags;
         }
 
@@ -1292 +1483 @@
                                         ldb_search_default_callback,
                                         NULL);
+        ldb_req_set_location(req, "ldb_search");
 
         if (ret != LDB_SUCCESS) goto done;
@@ -1335 +1527 @@
                                         ldb_op_default_callback,
                                         NULL);
+        ldb_req_set_location(req, "ldb_add");
 
         if (ret != LDB_SUCCESS) return ret;
@@ -1365 +1558 @@
                                         ldb_op_default_callback,
                                         NULL);
+        ldb_req_set_location(req, "ldb_modify");
 
         if (ret != LDB_SUCCESS) return ret;
@@ -1390 +1584 @@
                                         ldb_op_default_callback,
                                         NULL);
+        ldb_req_set_location(req, "ldb_delete");
 
         if (ret != LDB_SUCCESS) return ret;
@@ -1416 +1611 @@
                                         ldb_op_default_callback,
                                         NULL);
+        ldb_req_set_location(req, "ldb_rename");
 
         if (ret != LDB_SUCCESS) return ret;
@@ -1640 +1836 @@
         ldb->flags = flags;
 }
+
+
+/*
+  set the location in a ldb request. Used for debugging
+ */
+void ldb_req_set_location(struct ldb_request *req, const char *location)
+{
+        if (req && req->handle) {
+                req->handle->location = location;
+        }
+}
+
+/*
+  return the location set with dsdb_req_set_location
+ */
+const char *ldb_req_location(struct ldb_request *req)
+{
+        return req->handle->location;
+}
+
+/**
+  mark a request as untrusted. This tells the rootdse module to remove
+  unregistered controls
+ */
+void ldb_req_mark_untrusted(struct ldb_request *req)
+{
+        req->handle->flags |= LDB_HANDLE_FLAG_UNTRUSTED;
+}
+
+/**
+  mark a request as trusted.
+ */
+void ldb_req_mark_trusted(struct ldb_request *req)
+{
+        req->handle->flags &= ~LDB_HANDLE_FLAG_UNTRUSTED;
+}
+
+/**
+   return true is a request is untrusted
+ */
+bool ldb_req_is_untrusted(struct ldb_request *req)
+{
+        return (req->handle->flags & LDB_HANDLE_FLAG_UNTRUSTED) != 0;
+}

trunk/server/source4/lib/ldb/common/ldb_attributes.c

@@ -50 +50 @@
                                          const struct ldb_schema_syntax *syntax)
 {
-        int i, n;
+        unsigned int i, n;
         struct ldb_schema_attribute *a;
 
@@ -123 +123 @@
         const char *name)
 {
-        int i, e, b = 0, r;
+        /* for binary search we need signed variables */
+        unsigned int i, e, b = 0;
+        int r;
         const struct ldb_schema_attribute *def = &ldb_attribute_default;
 
@@ -135 +137 @@
         e = ldb->schema.num_attributes - 1;
 
-        while (b <= e) {
-
+        while ((b <= e) && (e != (unsigned int) -1)) {
                 i = (b + e) / 2;
 
@@ -148 +149 @@
                         b = i + 1;
                 }
-
         }
 
@@ -180 +180 @@
 {
         const struct ldb_schema_attribute *a;
-        int i;
+        ptrdiff_t i;
 
         a = ldb_schema_attribute_by_name_internal(ldb, name);
@@ -233 +233 @@
                 { "objectClass", LDB_SYNTAX_OBJECTCLASS }
         };
-        int i;
+        unsigned int i;
         int ret;
 
@@ -255 +255 @@
                                const struct ldb_dn_extended_syntax *syntax)
 {
-        int n;
+        unsigned int n;
         struct ldb_dn_extended_syntax *a;
 
@@ -285 +285 @@
                                                                     const char *name)
 {
-        int i;
+        unsigned int i;
         for (i=0; i < ldb->schema.num_dn_extended_syntax; i++) {
                 if (ldb_attr_cmp(ldb->schema.dn_extended_syntax[i].name, name) == 0) {

trunk/server/source4/lib/ldb/common/ldb_controls.c

@@ -38 +38 @@
 struct ldb_control *ldb_request_get_control(struct ldb_request *req, const char *oid)
 {
-        int i;
+        unsigned int i;
 
         if (req->controls != NULL) {
                 for (i = 0; req->controls[i]; i++) {
-                        if (strcmp(oid, req->controls[i]->oid) == 0) {
+                        if (req->controls[i]->oid && strcmp(oid, req->controls[i]->oid) == 0) {
                                 break;
                         }
@@ -57 +57 @@
 struct ldb_control *ldb_reply_get_control(struct ldb_reply *rep, const char *oid)
 {
-        int i;
+        unsigned int i;
 
         if (rep->controls != NULL) {
                 for (i = 0; rep->controls[i]; i++) {
-                        if (strcmp(oid, rep->controls[i]->oid) == 0) {
+                        if (rep->controls[i]->oid && strcmp(oid, rep->controls[i]->oid) == 0) {
                                 break;
                         }
@@ -72 +72 @@
 }
 
-/* saves the current controls list into the "saver" and replace the one in req with a new one excluding
-the "exclude" control */
-/* returns 0 on error */
-int save_controls(struct ldb_control *exclude, struct ldb_request *req, struct ldb_control ***saver)
+/*
+ * Saves the current controls list into the "saver" (can also be NULL) and
+ * replace the one in "req" with a new one excluding the "exclude" control
+ * (if it is NULL then the list remains the same)
+ *
+ * Returns 0 on error.
+ */
+int ldb_save_controls(struct ldb_control *exclude, struct ldb_request *req, struct ldb_control ***saver)
 {
-        struct ldb_control **lcs;
-        int i, j;
-
-        *saver = req->controls;
-        for (i = 0; req->controls[i]; i++);
-        if (i == 1) {
+        struct ldb_control **lcs, **lcs_old;
+        unsigned int i, j;
+
+        lcs_old = req->controls;
+        if (saver != NULL) {
+                *saver = lcs_old;
+        }
+
+        for (i = 0; req->controls && req->controls[i]; i++);
+        if (i == 0) {
                 req->controls = NULL;
                 return 1;
         }
 
-        lcs = talloc_array(req, struct ldb_control *, i);
+        lcs = talloc_array(req, struct ldb_control *, i + 1);
         if (!lcs) {
                 return 0;
         }
 
-        for (i = 0, j = 0; (*saver)[i]; i++) {
-                if (exclude == (*saver)[i]) continue;
-                lcs[j] = (*saver)[i];
+        for (i = 0, j = 0; lcs_old[i]; i++) {
+                if (exclude == lcs_old[i]) continue;
+                lcs[j] = lcs_old[i];
                 j++;
         }
         lcs[j] = NULL;
 
-        req->controls = lcs;
+        req->controls = talloc_realloc(req, lcs, struct ldb_control *, j + 1);
+        if (req->controls == NULL) {
+                return 0;
+        }
         return 1;
 }
 
+/*
+ * Returns a list of controls, except the one specified with "exclude" (can
+ * also be NULL).  Included controls become a child of returned list if they
+ * were children of "controls_in".
+ *
+ * Returns NULL on error (OOM) or an empty control list.
+ */
+struct ldb_control **ldb_controls_except_specified(struct ldb_control **controls_in, 
+                                               TALLOC_CTX *mem_ctx, 
+                                               struct ldb_control *exclude)
+{
+        struct ldb_control **lcs = NULL;
+        unsigned int i, j, n;
+
+        for (i = 0; controls_in && controls_in[i]; i++);
+        if (i == 0) {
+                return NULL;
+        }
+        n = i;
+
+        for (i = 0, j = 0; controls_in && controls_in[i]; i++) {
+                if (exclude == controls_in[i]) continue;
+
+                if (!lcs) {
+                        /* Allocate here so if we remove the only
+                         * control, or there were no controls, we
+                         * don't allocate at all, and just return
+                         * NULL */
+                        lcs = talloc_array(mem_ctx, struct ldb_control *,
+                                           n + 1);
+                        if (!lcs) {
+                                return NULL;
+                        }
+                }
+
+                lcs[j] = controls_in[i];
+                talloc_reparent(controls_in, lcs, lcs[j]);
+                j++;
+        }
+        if (lcs) {
+                lcs[j] = NULL;
+
+                lcs = talloc_realloc(mem_ctx, lcs, struct ldb_control *, j + 1);
+        }
+
+        return lcs;
+}
+
 /* check if there's any control marked as critical in the list */
 /* return True if any, False if none */
-int check_critical_controls(struct ldb_control **controls)
+int ldb_check_critical_controls(struct ldb_control **controls)
 {
-        int i;
+        unsigned int i;
 
         if (controls == NULL) {
@@ -123 +182 @@
 
 int ldb_request_add_control(struct ldb_request *req, const char *oid, bool critical, void *data)
+{
+        unsigned int i, n;
+        struct ldb_control **ctrls;
+        struct ldb_control *ctrl;
+
+        for (n=0; req->controls && req->controls[n];n++) { 
+                /* having two controls of the same OID makes no sense */
+                if (req->controls[n]->oid && strcmp(oid, req->controls[n]->oid) == 0) {
+                        return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
+                }
+        }
+
+        ctrls = talloc_array(req,
+                               struct ldb_control *,
+                               n + 2);
+        if (!ctrls) return LDB_ERR_OPERATIONS_ERROR;
+
+        for (i=0; i<n; i++) {
+                ctrls[i] = req->controls[i];
+        }
+
+        req->controls = ctrls;
+        ctrls[n] = NULL;
+        ctrls[n+1] = NULL;
+
+        ctrl = talloc(ctrls, struct ldb_control);
+        if (!ctrl) return LDB_ERR_OPERATIONS_ERROR;
+
+        ctrl->oid       = talloc_strdup(ctrl, oid);
+        if (!ctrl->oid) return LDB_ERR_OPERATIONS_ERROR;
+        ctrl->critical  = critical;
+        ctrl->data      = data;
+
+        ctrls[n] = ctrl;
+        return LDB_SUCCESS;
+}
+
+int ldb_reply_add_control(struct ldb_reply *ares, const char *oid, bool critical, void *data)
 {
         unsigned n;
@@ -128 +225 @@
         struct ldb_control *ctrl;
 
-        for (n=0; req->controls && req->controls[n];) { 
+        for (n=0; ares->controls && ares->controls[n];) { 
                 /* having two controls of the same OID makes no sense */
-                if (strcmp(oid, req->controls[n]->oid) == 0) {
+                if (ares->controls[n]->oid && strcmp(oid, ares->controls[n]->oid) == 0) {
                         return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
                 }
@@ -136 +233 @@
         }
 
-        ctrls = talloc_realloc(req, req->controls,
+        ctrls = talloc_realloc(ares, ares->controls,
                                struct ldb_control *,
                                n + 2);
         if (!ctrls) return LDB_ERR_OPERATIONS_ERROR;
-        req->controls = ctrls;
+        ares->controls = ctrls;
         ctrls[n] = NULL;
         ctrls[n+1] = NULL;
@@ -156 +253 @@
 }
 
-/* Parse controls from the format used on the command line and in ejs */
-
-struct ldb_control **ldb_parse_control_strings(struct ldb_context *ldb, void *mem_ctx, const char **control_strings)
+/* Add a control to the request, replacing the old one if it is already in the request */
+int ldb_request_replace_control(struct ldb_request *req, const char *oid, bool critical, void *data)
 {
-        int i;
-        struct ldb_control **ctrl;
-
+        unsigned int n;
+        int ret;
+
+        ret = ldb_request_add_control(req, oid, critical, data);
+        if (ret != LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
+                return ret;
+        }
+
+        for (n=0; req->controls[n];n++) {
+                if (req->controls[n]->oid && strcmp(oid, req->controls[n]->oid) == 0) {
+                        req->controls[n]->critical = critical;
+                        req->controls[n]->data = data;
+                        return LDB_SUCCESS;
+                }
+        }
+
+        return LDB_ERR_OPERATIONS_ERROR;
+}
+
+/*
+ * Return a control as string
+ * the project (ie. name:value1:value2:...:valuen
+ * The string didn't include the criticity of the critical flag
+ */
+char *ldb_control_to_string(TALLOC_CTX *mem_ctx, const struct ldb_control *control)
+{
+        char *res = NULL;
+
+        if (strcmp(control->oid, LDB_CONTROL_PAGED_RESULTS_OID) == 0) {
+                struct ldb_paged_control *rep_control = talloc_get_type(control->data, struct ldb_paged_control);
+                char *cookie;
+
+                cookie = ldb_base64_encode(mem_ctx, rep_control->cookie, rep_control->cookie_len);
+                if (cookie == NULL) {
+                        return NULL;
+                }
+                if (cookie[0] != '\0') {
+                        res = talloc_asprintf(mem_ctx, "%s:%d:%s",
+                                                LDB_CONTROL_PAGED_RESULTS_NAME,
+                                                control->critical,
+                                                cookie);
+
+                        talloc_free(cookie);
+                } else {
+                        res = talloc_asprintf(mem_ctx, "%s:%d",
+                                                LDB_CONTROL_PAGED_RESULTS_NAME,
+                                                control->critical);
+                }
+                return res;
+        }
+
+        if (strcmp(control->oid, LDB_CONTROL_VLV_RESP_OID) == 0) {
+                struct ldb_vlv_resp_control *rep_control = talloc_get_type(control->data,
+                                                                struct ldb_vlv_resp_control);
+
+                res = talloc_asprintf(mem_ctx, "%s:%d:%d:%d:%d:%d:%s",
+                                                LDB_CONTROL_VLV_RESP_NAME,
+                                                control->critical,
+                                                rep_control->targetPosition,
+                                                rep_control->contentCount,
+                                                rep_control->vlv_result,
+                                                rep_control->ctxid_len,
+                                                rep_control->contextId);
+
+                return res;
+        }
+
+        if (strcmp(control->oid, LDB_CONTROL_SORT_RESP_OID) == 0) {
+                struct ldb_sort_resp_control *rep_control = talloc_get_type(control->data,
+                                                                struct ldb_sort_resp_control);
+
+                res = talloc_asprintf(mem_ctx, "%s:%d:%d:%s",
+                                        LDB_CONTROL_SORT_RESP_NAME,
+                                        control->critical,
+                                        rep_control->result,
+                                        rep_control->attr_desc);
+
+                return res;
+        }
+
+        if (strcmp(control->oid, LDB_CONTROL_ASQ_OID) == 0) {
+                struct ldb_asq_control *rep_control = talloc_get_type(control->data,
+                                                                struct ldb_asq_control);
+
+                res = talloc_asprintf(mem_ctx, "%s:%d:%d",
+                                        LDB_CONTROL_SORT_RESP_NAME,
+                                        control->critical,
+                                        rep_control->result);
+
+                return res;
+        }
+
+        if (strcmp(control->oid, LDB_CONTROL_DIRSYNC_OID) == 0) {
+                char *cookie;
+                struct ldb_dirsync_control *rep_control = talloc_get_type(control->data,
+                                                                struct ldb_dirsync_control);
+
+                cookie = ldb_base64_encode(mem_ctx, rep_control->cookie,
+                                rep_control->cookie_len);
+                if (cookie == NULL) {
+                        return NULL;
+                }
+                res = talloc_asprintf(mem_ctx, "%s:%d:%d:%d:%s",
+                                        LDB_CONTROL_DIRSYNC_NAME,
+                                        control->critical,
+                                        rep_control->flags,
+                                        rep_control->max_attributes,
+                                        cookie);
+
+                talloc_free(cookie);
+                return res;
+        }
+
+        /*
+         * From here we don't know the control
+         */
+        if (control->data == NULL) {
+                /*
+                 * We don't know the control but there is no real data attached to it
+                 * so we can represent it with local_oid:oid:criticity
+                 */
+                res = talloc_asprintf(mem_ctx, "local_oid:%s:%d",
+                                        control->oid,
+                                        control->critical);
+                return res;
+        }
+
+                res = talloc_asprintf(mem_ctx, "unknown oid:%s",
+                                        control->oid);
+        return res;
+}
+
+
+/*
+ * A little trick to allow to use constants defined in headers rather than
+ * hardwritten in the file hardwritten in the file
+ * sizeof will return the \0 char as well so it will take the place of ":" in the
+ * length of the string
+ */
+#define LDB_CONTROL_CMP(control, NAME) strncmp(control, NAME ":", sizeof(NAME))
+
+/* Parse one string and return associated control if parsing is successful*/
+struct ldb_control *ldb_parse_control_from_string(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *control_strings)
+{
+        struct ldb_control *ctrl;
         char *error_string = NULL;
 
-        if (control_strings == NULL || control_strings[0] == NULL)
+        if (!(ctrl = talloc(mem_ctx, struct ldb_control))) {
+                ldb_oom(ldb);
                 return NULL;
-
-        for (i = 0; control_strings[i]; i++);
-
-        ctrl = talloc_array(mem_ctx, struct ldb_control *, i + 1);
-
-        for (i = 0; control_strings[i]; i++) {
-                if (strncmp(control_strings[i], "vlv:", 4) == 0) {
-                        struct ldb_vlv_req_control *control;
-                        const char *p;
-                        char attr[1024];
-                        char ctxid[1024];
-                        int crit, bc, ac, os, cc, ret;
-
-                        attr[0] = '\0';
-                        ctxid[0] = '\0';
-                        p = &(control_strings[i][4]);
-                        ret = sscanf(p, "%d:%d:%d:%d:%d:%1023[^$]", &crit, &bc, &ac, &os, &cc, ctxid);
-                        if (ret < 5) {
-                                ret = sscanf(p, "%d:%d:%d:%1023[^:]:%1023[^$]", &crit, &bc, &ac, attr, ctxid);
-                        }
-                               
-                        if ((ret < 4) || (crit < 0) || (crit > 1)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid server_sort control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b):bc(n):ac(n):<os(n):cc(n)|attr(s)>[:ctxid(o)]\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number, s = string, o = b64 binary blob");
+        }
+
+        if (LDB_CONTROL_CMP(control_strings,
+                                LDB_CONTROL_VLV_REQ_NAME) == 0) {
+                struct ldb_vlv_req_control *control;
+                const char *p;
+                char attr[1024];
+                char ctxid[1024];
+                int crit, bc, ac, os, cc, ret;
+
+                attr[0] = '\0';
+                ctxid[0] = '\0';
+                p = &(control_strings[sizeof(LDB_CONTROL_VLV_REQ_NAME)]);
+                ret = sscanf(p, "%d:%d:%d:%d:%d:%1023[^$]", &crit, &bc, &ac, &os, &cc, ctxid);
+                if (ret < 5) {
+                        ret = sscanf(p, "%d:%d:%d:%1023[^:]:%1023[^$]", &crit, &bc, &ac, attr, ctxid);
+                }
+                        
+                if ((ret < 4) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid server_sort control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b):bc(n):ac(n):<os(n):cc(n)|attr(s)>[:ctxid(o)]\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number, s = string, o = b64 binary blob");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+                ctrl->oid = LDB_CONTROL_VLV_REQ_OID;
+                ctrl->critical = crit;
+                if (!(control = talloc(ctrl,
+                                        struct ldb_vlv_req_control))) {
+                        ldb_oom(ldb);
+                        return NULL;
+                }
+                control->beforeCount = bc;
+                control->afterCount = ac;
+                if (attr[0]) {
+                        control->type = 1;
+                        control->match.gtOrEq.value = talloc_strdup(control, attr);
+                        control->match.gtOrEq.value_len = strlen(attr);
+                } else {
+                        control->type = 0;
+                        control->match.byOffset.offset = os;
+                        control->match.byOffset.contentCount = cc;
+                }
+                if (ctxid[0]) {
+                        control->ctxid_len = ldb_base64_decode(ctxid);
+                        control->contextId = (char *)talloc_memdup(control, ctxid, control->ctxid_len);
+                } else {
+                        control->ctxid_len = 0;
+                        control->contextId = NULL;
+                }
+                ctrl->data = control;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_DIRSYNC_NAME) == 0) {
+                struct ldb_dirsync_control *control;
+                const char *p;
+                char cookie[1024];
+                int crit, flags, max_attrs, ret;
+                
+                cookie[0] = '\0';
+                p = &(control_strings[sizeof(LDB_CONTROL_DIRSYNC_NAME)]);
+                ret = sscanf(p, "%d:%d:%d:%1023[^$]", &crit, &flags, &max_attrs, cookie);
+
+                if ((ret < 3) || (crit < 0) || (crit > 1) || (flags < 0) || (max_attrs < 0)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid dirsync control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b):flags(n):max_attrs(n)[:cookie(o)]\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number, o = b64 binary blob");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                /* w2k3 seems to ignore the parameter,
+                        * but w2k sends a wrong cookie when this value is to small
+                        * this would cause looping forever, while getting
+                        * the same data and same cookie forever
+                        */
+                if (max_attrs == 0) max_attrs = 0x0FFFFFFF;
+
+                ctrl->oid = LDB_CONTROL_DIRSYNC_OID;
+                ctrl->critical = crit;
+                control = talloc(ctrl, struct ldb_dirsync_control);
+                control->flags = flags;
+                control->max_attributes = max_attrs;
+                if (*cookie) {
+                        control->cookie_len = ldb_base64_decode(cookie);
+                        control->cookie = (char *)talloc_memdup(control, cookie, control->cookie_len);
+                } else {
+                        control->cookie = NULL;
+                        control->cookie_len = 0;
+                }
+                ctrl->data = control;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_ASQ_NAME) == 0) {
+                struct ldb_asq_control *control;
+                const char *p;
+                char attr[256];
+                int crit, ret;
+
+                attr[0] = '\0';
+                p = &(control_strings[sizeof(LDB_CONTROL_ASQ_NAME)]);
+                ret = sscanf(p, "%d:%255[^$]", &crit, attr);
+                if ((ret != 2) || (crit < 0) || (crit > 1) || (attr[0] == '\0')) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid asq control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b):attr(s)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, s = string");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_ASQ_OID;
+                ctrl->critical = crit;
+                control = talloc(ctrl, struct ldb_asq_control);
+                control->request = 1;
+                control->source_attribute = talloc_strdup(control, attr);
+                control->src_attr_len = strlen(attr);
+                ctrl->data = control;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_EXTENDED_DN_NAME) == 0) {
+                struct ldb_extended_dn_control *control;
+                const char *p;
+                int crit, type, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_EXTENDED_DN_NAME)]);
+                ret = sscanf(p, "%d:%d", &crit, &type);
+                if ((ret != 2) || (crit < 0) || (crit > 1) || (type < 0) || (type > 1)) {
+                        ret = sscanf(p, "%d", &crit);
+                        if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                                error_string = talloc_asprintf(mem_ctx, "invalid extended_dn control syntax\n");
+                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b)[:type(i)]\n");
+                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean\n");
+                                error_string = talloc_asprintf_append(error_string, "         i = integer\n");
+                                error_string = talloc_asprintf_append(error_string, "   valid values are: 0 - hexadecimal representation\n");
+                                error_string = talloc_asprintf_append(error_string, "                     1 - normal string representation");
                                 ldb_set_errstring(ldb, error_string);
                                 talloc_free(error_string);
                                 return NULL;
                         }
-                        if (!(ctrl[i] = talloc(ctrl, struct ldb_control))) {
-                                ldb_oom(ldb);
-                                return NULL;
+                        control = NULL;
+                } else {
+                        control = talloc(ctrl, struct ldb_extended_dn_control);
+                        control->type = type;
+                }
+
+                ctrl->oid = LDB_CONTROL_EXTENDED_DN_OID;
+                ctrl->critical = crit;
+                ctrl->data = talloc_steal(ctrl, control);
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_SD_FLAGS_NAME) == 0) {
+                struct ldb_sd_flags_control *control;
+                const char *p;
+                int crit, ret;
+                unsigned secinfo_flags;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_SD_FLAGS_NAME)]);
+                ret = sscanf(p, "%d:%u", &crit, &secinfo_flags);
+                if ((ret != 2) || (crit < 0) || (crit > 1) || (secinfo_flags < 0) || (secinfo_flags > 0xF)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid sd_flags control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b):secinfo_flags(n)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_SD_FLAGS_OID;
+                ctrl->critical = crit;
+                control = talloc(ctrl, struct ldb_sd_flags_control);
+                control->secinfo_flags = secinfo_flags;
+                ctrl->data = control;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_SEARCH_OPTIONS_NAME) == 0) {
+                struct ldb_search_options_control *control;
+                const char *p;
+                int crit, ret;
+                unsigned search_options;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_SEARCH_OPTIONS_NAME)]);
+                ret = sscanf(p, "%d:%u", &crit, &search_options);
+                if ((ret != 2) || (crit < 0) || (crit > 1) || (search_options < 0) || (search_options > 0xF)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid search_options control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b):search_options(n)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_SEARCH_OPTIONS_OID;
+                ctrl->critical = crit;
+                control = talloc(ctrl, struct ldb_search_options_control);
+                control->search_options = search_options;
+                ctrl->data = control;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_BYPASS_OPERATIONAL_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_BYPASS_OPERATIONAL_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid bypassopreational control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_BYPASS_OPERATIONAL_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_RELAX_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_RELAX_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid relax control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_RELAX_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_RECALCULATE_SD_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_RECALCULATE_SD_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid recalculate_sd control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_RECALCULATE_SD_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_DOMAIN_SCOPE_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_DOMAIN_SCOPE_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid domain_scope control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_DOMAIN_SCOPE_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_PAGED_RESULTS_NAME) == 0) {
+                struct ldb_paged_control *control;
+                const char *p;
+                int crit, size, ret;
+                
+                p = &(control_strings[sizeof(LDB_CONTROL_PAGED_RESULTS_NAME)]);
+                ret = sscanf(p, "%d:%d", &crit, &size);
+                if ((ret != 2) || (crit < 0) || (crit > 1) || (size < 0)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid paged_results control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b):size(n)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_PAGED_RESULTS_OID;
+                ctrl->critical = crit;
+                control = talloc(ctrl, struct ldb_paged_control);
+                control->size = size;
+                control->cookie = NULL;
+                control->cookie_len = 0;
+                ctrl->data = control;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_SERVER_SORT_NAME) == 0) {
+                struct ldb_server_sort_control **control;
+                const char *p;
+                char attr[256];
+                char rule[128];
+                int crit, rev, ret;
+
+                attr[0] = '\0';
+                rule[0] = '\0';
+                p = &(control_strings[sizeof(LDB_CONTROL_SERVER_SORT_NAME)]);
+                ret = sscanf(p, "%d:%d:%255[^:]:%127[^:]", &crit, &rev, attr, rule);
+                if ((ret < 3) || (crit < 0) || (crit > 1) || (rev < 0 ) || (rev > 1) ||attr[0] == '\0') {
+                        error_string = talloc_asprintf(mem_ctx, "invalid server_sort control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b):rev(b):attr(s)[:rule(s)]\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, s = string");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+                ctrl->oid = LDB_CONTROL_SERVER_SORT_OID;
+                ctrl->critical = crit;
+                control = talloc_array(ctrl, struct ldb_server_sort_control *, 2);
+                control[0] = talloc(control, struct ldb_server_sort_control);
+                control[0]->attributeName = talloc_strdup(control, attr);
+                if (rule[0])
+                        control[0]->orderingRule = talloc_strdup(control, rule);
+                else
+                        control[0]->orderingRule = NULL;
+                control[0]->reverse = rev;
+                control[1] = NULL;
+                ctrl->data = control;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_NOTIFICATION_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_NOTIFICATION_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid notification control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_NOTIFICATION_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_TREE_DELETE_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_TREE_DELETE_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid tree_delete control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_TREE_DELETE_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_SHOW_DELETED_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_SHOW_DELETED_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid show_deleted control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_SHOW_DELETED_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_SHOW_DEACTIVATED_LINK_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_SHOW_DEACTIVATED_LINK_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid show_deactivated_link control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_SHOW_DEACTIVATED_LINK_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_SHOW_RECYCLED_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_SHOW_RECYCLED_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid show_recycled control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_SHOW_RECYCLED_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_PERMISSIVE_MODIFY_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_PERMISSIVE_MODIFY_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid permissive_modify control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_PERMISSIVE_MODIFY_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_REVEAL_INTERNALS_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_REVEAL_INTERNALS_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid reveal_internals control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_REVEAL_INTERNALS;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (strncmp(control_strings, "local_oid:", 10) == 0) {
+                const char *p;
+                int crit = 0, ret = 0;
+                char oid[256];
+
+                oid[0] = '\0';
+                p = &(control_strings[10]);
+                ret = sscanf(p, "%64[^:]:%d", oid, &crit);
+
+                if ((ret != 2) || strlen(oid) == 0 || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid local_oid control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: oid(s):crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean, s = string");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = talloc_strdup(ctrl, oid);
+                if (!ctrl->oid) {
+                        ldb_oom(ldb);
+                        return NULL;
+                }
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_RODC_DCPROMO_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_RODC_DCPROMO_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid rodc_join control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_RODC_DCPROMO_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+
+        if (LDB_CONTROL_CMP(control_strings, LDB_CONTROL_PROVISION_NAME) == 0) {
+                const char *p;
+                int crit, ret;
+
+                p = &(control_strings[sizeof(LDB_CONTROL_PROVISION_NAME)]);
+                ret = sscanf(p, "%d", &crit);
+                if ((ret != 1) || (crit < 0) || (crit > 1)) {
+                        error_string = talloc_asprintf(mem_ctx, "invalid provision control syntax\n");
+                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
+                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
+                        ldb_set_errstring(ldb, error_string);
+                        talloc_free(error_string);
+                        return NULL;
+                }
+
+                ctrl->oid = LDB_CONTROL_PROVISION_OID;
+                ctrl->critical = crit;
+                ctrl->data = NULL;
+
+                return ctrl;
+        }
+        /*
+         * When no matching control has been found.
+         */
+        return NULL;
+}
+
+/*
+ * A little trick to allow to use constants defined in headers rather than
+ * hardwritten in the file hardwritten in the file
+ * sizeof will return the \0 char as well so it will take the place of ":" in the
+ * length of the string
+ */
+#define LDB_CONTROL_CMP(control, NAME) strncmp(control, NAME ":", sizeof(NAME))
+
+/* Parse controls from the format used on the command line and in ejs */
+struct ldb_control **ldb_parse_control_strings(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char **control_strings)
+{
+        unsigned int i;
+        struct ldb_control **ctrl;
+
+        if (control_strings == NULL || control_strings[0] == NULL)
+                return NULL;
+
+        for (i = 0; control_strings[i]; i++);
+
+        ctrl = talloc_array(mem_ctx, struct ldb_control *, i + 1);
+
+        ldb_reset_err_string(ldb);
+        for (i = 0; control_strings[i]; i++) {
+                ctrl[i] = ldb_parse_control_from_string(ldb, ctrl, control_strings[i]);
+                if (ctrl[i] == NULL) {
+                        if( ldb_errstring == NULL ) {
+                                /* no controls matched, throw an error */
+                                ldb_asprintf_errstring(ldb, "Invalid control name: '%s'", control_strings[i]);
                         }
-                        ctrl[i]->oid = LDB_CONTROL_VLV_REQ_OID;
-                        ctrl[i]->critical = crit;
-                        if (!(control = talloc(ctrl[i],
-                                               struct ldb_vlv_req_control))) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        control->beforeCount = bc;
-                        control->afterCount = ac;
-                        if (attr[0]) {
-                                control->type = 1;
-                                control->match.gtOrEq.value = talloc_strdup(control, attr);
-                                control->match.gtOrEq.value_len = strlen(attr);
-                        } else {
-                                control->type = 0;
-                                control->match.byOffset.offset = os;
-                                control->match.byOffset.contentCount = cc;
-                        }
-                        if (ctxid[0]) {
-                                control->ctxid_len = ldb_base64_decode(ctxid);
-                                control->contextId = (char *)talloc_memdup(control, ctxid, control->ctxid_len);
-                        } else {
-                                control->ctxid_len = 0;
-                                control->contextId = NULL;
-                        }
-                        ctrl[i]->data = control;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "dirsync:", 8) == 0) {
-                        struct ldb_dirsync_control *control;
-                        const char *p;
-                        char cookie[1024];
-                        int crit, flags, max_attrs, ret;
-                       
-                        cookie[0] = '\0';
-                        p = &(control_strings[i][8]);
-                        ret = sscanf(p, "%d:%d:%d:%1023[^$]", &crit, &flags, &max_attrs, cookie);
-
-                        if ((ret < 3) || (crit < 0) || (crit > 1) || (flags < 0) || (max_attrs < 0)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid dirsync control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b):flags(n):max_attrs(n)[:cookie(o)]\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number, o = b64 binary blob");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        /* w2k3 seems to ignore the parameter,
-                         * but w2k sends a wrong cookie when this value is to small
-                         * this would cause looping forever, while getting
-                         * the same data and same cookie forever
-                         */
-                        if (max_attrs == 0) max_attrs = 0x0FFFFFFF;
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        ctrl[i]->oid = LDB_CONTROL_DIRSYNC_OID;
-                        ctrl[i]->critical = crit;
-                        control = talloc(ctrl[i], struct ldb_dirsync_control);
-                        control->flags = flags;
-                        control->max_attributes = max_attrs;
-                        if (*cookie) {
-                                control->cookie_len = ldb_base64_decode(cookie);
-                                control->cookie = (char *)talloc_memdup(control, cookie, control->cookie_len);
-                        } else {
-                                control->cookie = NULL;
-                                control->cookie_len = 0;
-                        }
-                        ctrl[i]->data = control;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "asq:", 4) == 0) {
-                        struct ldb_asq_control *control;
-                        const char *p;
-                        char attr[256];
-                        int crit, ret;
-
-                        attr[0] = '\0';
-                        p = &(control_strings[i][4]);
-                        ret = sscanf(p, "%d:%255[^$]", &crit, attr);
-                        if ((ret != 2) || (crit < 0) || (crit > 1) || (attr[0] == '\0')) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid asq control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b):attr(s)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean, s = string");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_ASQ_OID;
-                        ctrl[i]->critical = crit;
-                        control = talloc(ctrl[i], struct ldb_asq_control);
-                        control->request = 1;
-                        control->source_attribute = talloc_strdup(control, attr);
-                        control->src_attr_len = strlen(attr);
-                        ctrl[i]->data = control;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "extended_dn:", 12) == 0) {
-                        struct ldb_extended_dn_control *control;
-                        const char *p;
-                        int crit, type, ret;
-
-                        p = &(control_strings[i][12]);
-                        ret = sscanf(p, "%d:%d", &crit, &type);
-                        if ((ret != 2) || (crit < 0) || (crit > 1) || (type < 0) || (type > 1)) {
-                                ret = sscanf(p, "%d", &crit);
-                                if ((ret != 1) || (crit < 0) || (crit > 1)) {
-                                        error_string = talloc_asprintf(mem_ctx, "invalid extended_dn control syntax\n");
-                                        error_string = talloc_asprintf_append(error_string, " syntax: crit(b)[:type(i)]\n");
-                                        error_string = talloc_asprintf_append(error_string, "   note: b = boolean\n");
-                                        error_string = talloc_asprintf_append(error_string, "         i = integer\n");
-                                        error_string = talloc_asprintf_append(error_string, "   valid values are: 0 - hexadecimal representation\n");
-                                        error_string = talloc_asprintf_append(error_string, "                     1 - normal string representation");
-                                        ldb_set_errstring(ldb, error_string);
-                                        talloc_free(error_string);
-                                        return NULL;
-                                }
-                                control = NULL;
-                        } else {
-                                control = talloc(ctrl, struct ldb_extended_dn_control);
-                                control->type = type;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_EXTENDED_DN_OID;
-                        ctrl[i]->critical = crit;
-                        ctrl[i]->data = talloc_steal(ctrl[i], control);
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "sd_flags:", 9) == 0) {
-                        struct ldb_sd_flags_control *control;
-                        const char *p;
-                        int crit, ret;
-                        unsigned secinfo_flags;
-
-                        p = &(control_strings[i][9]);
-                        ret = sscanf(p, "%d:%u", &crit, &secinfo_flags);
-                        if ((ret != 2) || (crit < 0) || (crit > 1) || (secinfo_flags < 0) || (secinfo_flags > 0xF)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid sd_flags control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b):secinfo_flags(n)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_SD_FLAGS_OID;
-                        ctrl[i]->critical = crit;
-                        control = talloc(ctrl[i], struct ldb_sd_flags_control);
-                        control->secinfo_flags = secinfo_flags;
-                        ctrl[i]->data = control;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "search_options:", 15) == 0) {
-                        struct ldb_search_options_control *control;
-                        const char *p;
-                        int crit, ret;
-                        unsigned search_options;
-
-                        p = &(control_strings[i][15]);
-                        ret = sscanf(p, "%d:%u", &crit, &search_options);
-                        if ((ret != 2) || (crit < 0) || (crit > 1) || (search_options < 0) || (search_options > 0xF)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid search_options control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b):search_options(n)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_SEARCH_OPTIONS_OID;
-                        ctrl[i]->critical = crit;
-                        control = talloc(ctrl[i], struct ldb_search_options_control);
-                        control->search_options = search_options;
-                        ctrl[i]->data = control;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "domain_scope:", 13) == 0) {
-                        const char *p;
-                        int crit, ret;
-
-                        p = &(control_strings[i][13]);
-                        ret = sscanf(p, "%d", &crit);
-                        if ((ret != 1) || (crit < 0) || (crit > 1)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid domain_scope control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_DOMAIN_SCOPE_OID;
-                        ctrl[i]->critical = crit;
-                        ctrl[i]->data = NULL;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "paged_results:", 14) == 0) {
-                        struct ldb_paged_control *control;
-                        const char *p;
-                        int crit, size, ret;
-                       
-                        p = &(control_strings[i][14]);
-                        ret = sscanf(p, "%d:%d", &crit, &size);
-
-                        if ((ret != 2) || (crit < 0) || (crit > 1) || (size < 0)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid paged_results control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b):size(n)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean, n = number");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_PAGED_RESULTS_OID;
-                        ctrl[i]->critical = crit;
-                        control = talloc(ctrl[i], struct ldb_paged_control);
-                        control->size = size;
-                        control->cookie = NULL;
-                        control->cookie_len = 0;
-                        ctrl[i]->data = control;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "server_sort:", 12) == 0) {
-                        struct ldb_server_sort_control **control;
-                        const char *p;
-                        char attr[256];
-                        char rule[128];
-                        int crit, rev, ret;
-
-                        attr[0] = '\0';
-                        rule[0] = '\0';
-                        p = &(control_strings[i][12]);
-                        ret = sscanf(p, "%d:%d:%255[^:]:%127[^:]", &crit, &rev, attr, rule);
-                        if ((ret < 3) || (crit < 0) || (crit > 1) || (rev < 0 ) || (rev > 1) ||attr[0] == '\0') {
-                                error_string = talloc_asprintf(mem_ctx, "invalid server_sort control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b):rev(b):attr(s)[:rule(s)]\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean, s = string");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_SERVER_SORT_OID;
-                        ctrl[i]->critical = crit;
-                        control = talloc_array(ctrl[i], struct ldb_server_sort_control *, 2);
-                        control[0] = talloc(control, struct ldb_server_sort_control);
-                        control[0]->attributeName = talloc_strdup(control, attr);
-                        if (rule[0])
-                                control[0]->orderingRule = talloc_strdup(control, rule);
-                        else
-                                control[0]->orderingRule = NULL;
-                        control[0]->reverse = rev;
-                        control[1] = NULL;
-                        ctrl[i]->data = control;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "notification:", 13) == 0) {
-                        const char *p;
-                        int crit, ret;
-
-                        p = &(control_strings[i][13]);
-                        ret = sscanf(p, "%d", &crit);
-                        if ((ret != 1) || (crit < 0) || (crit > 1)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid notification control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_NOTIFICATION_OID;
-                        ctrl[i]->critical = crit;
-                        ctrl[i]->data = NULL;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "show_deleted:", 13) == 0) {
-                        const char *p;
-                        int crit, ret;
-
-                        p = &(control_strings[i][13]);
-                        ret = sscanf(p, "%d", &crit);
-                        if ((ret != 1) || (crit < 0) || (crit > 1)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid show_deleted control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_SHOW_DELETED_OID;
-                        ctrl[i]->critical = crit;
-                        ctrl[i]->data = NULL;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "show_deactivated_link:", 22) == 0) {
-                        const char *p;
-                        int crit, ret;
-
-                        p = &(control_strings[i][22]);
-                        ret = sscanf(p, "%d", &crit);
-                        if ((ret != 1) || (crit < 0) || (crit > 1)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid show_deactivated_link control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_SHOW_DEACTIVATED_LINK_OID;
-                        ctrl[i]->critical = crit;
-                        ctrl[i]->data = NULL;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "show_recycled:", 14) == 0) {
-                        const char *p;
-                        int crit, ret;
-
-                        p = &(control_strings[i][14]);
-                        ret = sscanf(p, "%d", &crit);
-                        if ((ret != 1) || (crit < 0) || (crit > 1)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid show_recycled control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_SHOW_RECYCLED_OID;
-                        ctrl[i]->critical = crit;
-                        ctrl[i]->data = NULL;
-
-                        continue;
-                }
-
-                if (strncmp(control_strings[i], "permissive_modify:", 18) == 0) {
-                        const char *p;
-                        int crit, ret;
-
-                        p = &(control_strings[i][18]);
-                        ret = sscanf(p, "%d", &crit);
-                        if ((ret != 1) || (crit < 0) || (crit > 1)) {
-                                error_string = talloc_asprintf(mem_ctx, "invalid permissive_modify control syntax\n");
-                                error_string = talloc_asprintf_append(error_string, " syntax: crit(b)\n");
-                                error_string = talloc_asprintf_append(error_string, "   note: b = boolean");
-                                ldb_set_errstring(ldb, error_string);
-                                talloc_free(error_string);
-                                return NULL;
-                        }
-
-                        ctrl[i] = talloc(ctrl, struct ldb_control);
-                        if (!ctrl[i]) {
-                                ldb_oom(ldb);
-                                return NULL;
-                        }
-                        ctrl[i]->oid = LDB_CONTROL_PERMISSIVE_MODIFY_OID;
-                        ctrl[i]->critical = crit;
-                        ctrl[i]->data = NULL;
-
-                        continue;
-                }
-
-                /* no controls matched, throw an error */
-                ldb_asprintf_errstring(ldb, "Invalid control name: '%s'", control_strings[i]);
-                return NULL;
+                        talloc_free(ctrl);
+                        return NULL;
+                }
         }
 

trunk/server/source4/lib/ldb/common/ldb_dn.c

@@ -80 +80 @@
 };
 
+/* it is helpful to be able to break on this in gdb */
+static void ldb_dn_mark_invalid(struct ldb_dn *dn)
+{
+        dn->invalid = true;
+}
+
 /* strdn may be NULL */
-struct ldb_dn *ldb_dn_from_ldb_val(void *mem_ctx,
+struct ldb_dn *ldb_dn_from_ldb_val(TALLOC_CTX *mem_ctx,
                                    struct ldb_context *ldb,
                                    const struct ldb_val *strdn)
@@ -90 +96 @@
 
         if (strdn && strdn->data
-            && (strlen((const char*)strdn->data) != strdn->length)) {
+            && (strnlen((const char*)strdn->data, strdn->length) != strdn->length)) {
                 /* The RDN must not contain a character with value 0x0 */
                 return NULL;
@@ -98 +104 @@
         LDB_DN_NULL_FAILED(dn);
 
-        dn->ldb = ldb;
+        dn->ldb = talloc_get_type(ldb, struct ldb_context);
+        if (dn->ldb == NULL) {
+                /* the caller probably got the arguments to
+                   ldb_dn_new() mixed up */
+                talloc_free(dn);
+                return NULL;
+        }
 
         if (strdn->data && strdn->length) {
@@ -143 +155 @@
 
 /* strdn may be NULL */
-struct ldb_dn *ldb_dn_new(void *mem_ctx,
+struct ldb_dn *ldb_dn_new(TALLOC_CTX *mem_ctx,
                           struct ldb_context *ldb,
                           const char *strdn)
 {
         struct ldb_val blob;
-        blob.data = strdn;
+        blob.data = discard_const_p(uint8_t, strdn);
         blob.length = strdn ? strlen(strdn) : 0;
         return ldb_dn_from_ldb_val(mem_ctx, ldb, &blob);
 }
 
-struct ldb_dn *ldb_dn_new_fmt(void *mem_ctx,
+struct ldb_dn *ldb_dn_new_fmt(TALLOC_CTX *mem_ctx,
                               struct ldb_context *ldb,
                               const char *new_fmt, ...)
@@ -175 +187 @@
 }
 
+/* see RFC2253 section 2.4 */
 static int ldb_dn_escape_internal(char *dst, const char *src, int len)
 {
         const char *p, *s;
         char *d;
-        int l;
+        size_t l;
 
         p = s = src;
@@ -185 +198 @@
 
         while (p - src < len) {
-
-                p += strcspn(p, ",=\n+<>#;\\\"");
+                p += strcspn(p, ",=\n\r+<>#;\\\" ");
 
                 if (p - src == len) /* found no escapable chars */
@@ -194 +206 @@
                 memcpy(d, s, p - s);
                 d += (p - s); /* move to current position */
-
-                if (*p) { /* it is a normal escapable character */
+                
+                switch (*p) {
+                case ' ':
+                        if (p == src || (p-src)==(len-1)) {
+                                /* if at the beginning or end
+                                 * of the string then escape */
+                                *d++ = '\\';
+                                *d++ = *p++;                                     
+                        } else {
+                                /* otherwise don't escape */
+                                *d++ = *p++;
+                        }
+                        break;
+
+                case '#':
+                        /* despite the RFC, windows escapes a #
+                           anywhere in the string */
+                case ',':
+                case '+':
+                case '"':
+                case '\\':
+                case '<':
+                case '>':
+                case '?':
+                        /* these must be escaped using \c form */
                         *d++ = '\\';
                         *d++ = *p++;
-                } else { /* we have a zero byte in the string */
-                        strncpy(d, "\00", 3); /* escape the zero */
-                        d += 3;
-                        p++; /* skip the zero */
+                        break;
+
+                default: {
+                        /* any others get \XX form */
+                        unsigned char v;
+                        const char *hexbytes = "0123456789ABCDEF";
+                        v = *(const unsigned char *)p;
+                        *d++ = '\\';
+                        *d++ = hexbytes[v>>4];
+                        *d++ = hexbytes[v&0xF];
+                        p++;
+                        break;
+                }
                 }
                 s = p; /* move forward */
@@ -214 +258 @@
 }
 
-char *ldb_dn_escape_value(void *mem_ctx, struct ldb_val value)
+char *ldb_dn_escape_value(TALLOC_CTX *mem_ctx, struct ldb_val value)
 {
         char *dst;
@@ -245 +289 @@
 {
         char *p, *ex_name, *ex_value, *data, *d, *dt, *t;
-        bool trim = false;
-        bool in_extended = false;
+        bool trim = true;
+        bool in_extended = true;
         bool in_ex_name = false;
         bool in_ex_value = false;
@@ -254 +298 @@
         bool is_oid = false;
         bool escape = false;
-        unsigned x;
-        int l, ret;
+        unsigned int x;
+        size_t l;
+        int ret;
         char *parse_dn;
+        bool is_index;
 
         if ( ! dn || dn->invalid) return false;
@@ -274 +320 @@
         }
 
-        /* The RDN size must be less than 255 characters */
-        if (strlen(parse_dn) > 255) {
-                return false;
-        }
+        is_index = (strncmp(parse_dn, "DN=@INDEX:", 10) == 0);
 
         /* Empty DNs */
@@ -289 +332 @@
         }
 
-        /* make sure we free this if alloced previously before replacing */
-        talloc_free(dn->components);
-
-        talloc_free(dn->ext_components);
-        dn->ext_components = NULL;
+        /* make sure we free this if allocated previously before replacing */
+        LDB_FREE(dn->components);
+        dn->comp_num = 0;
+
+        LDB_FREE(dn->ext_components);
+        dn->ext_comp_num = 0;
 
         /* in the common case we have 3 or more components */
@@ -301 +345 @@
                 return false;
         }
-        dn->comp_num = 0;
 
         /* Components data space is allocated here once */
@@ -310 +353 @@
 
         p = parse_dn;
-        in_extended = true;
-        in_ex_name = false;
-        in_ex_value = false;
-        trim = true;
         t = NULL;
         d = dt = data;
@@ -384 +423 @@
                                                           &ex_val, &dn->ext_components[dn->ext_comp_num].value);
                                 if (ret != LDB_SUCCESS) {
-                                        dn->invalid = true;
+                                        ldb_dn_mark_invalid(dn);
                                         goto failed;
                                 }
@@ -399 +438 @@
                                         continue;
                                 } else {
-                                        dn->invalid = true;
+                                        ldb_dn_mark_invalid(dn);
                                         goto failed;
                                 }
@@ -419 +458 @@
                                 if (!isascii(*p)) {
                                         /* attr names must be ascii only */
-                                        dn->invalid = true;
+                                        ldb_dn_mark_invalid(dn);
                                         goto failed;
                                 }
@@ -429 +468 @@
                                         /* not a digit nor an alpha,
                                          * invalid attribute name */
-                                        dn->invalid = true;
+                                        ldb_dn_mark_invalid(dn);
                                         goto failed;
                                 }
@@ -448 +487 @@
                         if (trim && (*p != '=')) {
                                 /* spaces/tabs are not allowed */
-                                dn->invalid = true;
+                                ldb_dn_mark_invalid(dn);
                                 goto failed;
                         }
@@ -477 +516 @@
                         if (!isascii(*p)) {
                                 /* attr names must be ascii only */
-                                dn->invalid = true;
+                                ldb_dn_mark_invalid(dn);
                                 goto failed;
                         }
@@ -484 +523 @@
                                 /* not a digit nor a dot,
                                  * invalid attribute oid */
-                                dn->invalid = true;
+                                ldb_dn_mark_invalid(dn);
                                 goto failed;
                         } else
                         if ( ! (isalpha(*p) || isdigit(*p) || (*p == '-'))) {
                                 /* not ALPHA, DIGIT or HYPHEN */
-                                dn->invalid = true;
+                                ldb_dn_mark_invalid(dn);
                                 goto failed;
                         }
@@ -579 +618 @@
                                 continue;
 
+                        case '+':
                         case '=':
-                        case '\n':
-                        case '+':
+                                /* to main compatibility with earlier
+                                versions of ldb indexing, we have to
+                                accept the base64 encoded binary index
+                                values, which contain a '+' or '='
+                                which should normally be escaped */
+                                if (is_index) {
+                                        if ( t ) t = NULL;
+                                        *d++ = *p++;
+                                        l++;
+                                        break;
+                                }
+                                /* fall through */
+                        case '\"':
                         case '<':
                         case '>':
-                        case '#':
                         case ';':
-                        case '\"':
                                 /* a string with not escaped specials is invalid (tested) */
                                 if ( ! escape) {
-                                        dn->invalid = true;
+                                        ldb_dn_mark_invalid(dn);
                                         goto failed;
                                 }
@@ -616 +665 @@
                         default:
                                 if (escape) {
-                                        if (sscanf(p, "%02x", &x) != 1) {
-                                                /* invalid escaping sequence */
-                                                dn->invalid = true;
-                                                goto failed;
+                                        if (isxdigit(p[0]) && isxdigit(p[1])) {
+                                                if (sscanf(p, "%02x", &x) != 1) {
+                                                        /* invalid escaping sequence */
+                                                        ldb_dn_mark_invalid(dn);
+                                                        goto failed;
+                                                }
+                                                p += 2;
+                                                *d++ = (unsigned char)x;
+                                        } else {
+                                                *d++ = *p++;
                                         }
+
                                         escape = false;
-
-                                        p += 2;
-                                        *d++ = (unsigned char)x;
                                         l++;
-
                                         if ( t ) t = NULL;
                                         break;
@@ -648 +700 @@
         if (in_attr || in_quote) {
                 /* invalid dn */
-                dn->invalid = true;
+                ldb_dn_mark_invalid(dn);
                 goto failed;
         }
@@ -674 +726 @@
 
 failed:
+        LDB_FREE(dn->components); /* "data" is implicitly free'd */
         dn->comp_num = 0;
-        talloc_free(dn->components);
+        LDB_FREE(dn->ext_components);
+        dn->ext_comp_num = 0;
+
         return false;
 }
@@ -686 +741 @@
 const char *ldb_dn_get_linearized(struct ldb_dn *dn)
 {
-        int i, len;
+        unsigned int i;
+        size_t len;
         char *d, *n;
 
@@ -694 +750 @@
 
         if ( ! dn->components) {
-                dn->invalid = true;
+                ldb_dn_mark_invalid(dn);
                 return NULL;
         }
@@ -741 +797 @@
 }
 
-char *ldb_dn_get_extended_linearized(void *mem_ctx, struct ldb_dn *dn, int mode)
+static int ldb_dn_extended_component_compare(const void *p1, const void *p2)
+{
+        const struct ldb_dn_ext_component *ec1 = (const struct ldb_dn_ext_component *)p1;
+        const struct ldb_dn_ext_component *ec2 = (const struct ldb_dn_ext_component *)p2;
+        return strcmp(ec1->name, ec2->name);
+}
+
+char *ldb_dn_get_extended_linearized(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, int mode)
 {
         const char *linearized = ldb_dn_get_linearized(dn);
-        char *p;
-        int i;
+        char *p = NULL;
+        unsigned int i;
 
         if (!linearized) {
@@ -758 +821 @@
                 return NULL;
         }
+
+        /* sort the extended components by name. The idea is to make
+         * the resulting DNs consistent, plus to ensure that we put
+         * 'DELETED' first, so it can be very quickly recognised
+         */
+        TYPESAFE_QSORT(dn->ext_components, dn->ext_comp_num,
+                       ldb_dn_extended_component_compare);
 
         for (i = 0; i < dn->ext_comp_num; i++) {
@@ -767 +837 @@
 
                 ext_syntax = ldb_dn_extended_syntax_by_name(dn->ldb, name);
+                if (!ext_syntax) {
+                        return NULL;
+                }
 
                 if (mode == 1) {
@@ -783 +856 @@
 
                 if (i == 0) {
-                        p = talloc_asprintf(mem_ctx, "<%s=%s>",
-                                                        name, val.data);
+                        p = talloc_asprintf(mem_ctx, "<%s=%s>", 
+                                            name, val.data);
                 } else {
-                        p = talloc_asprintf_append(p, ";<%s=%s>",
-                                                        name, val.data);
+                        p = talloc_asprintf_append_buffer(p, ";<%s=%s>",
+                                                          name, val.data);
                 }
 
@@ -798 +871 @@
 
         if (dn->ext_comp_num && *linearized) {
-                p = talloc_asprintf_append(p, ";%s", linearized);
+                p = talloc_asprintf_append_buffer(p, ";%s", linearized);
         }
 
@@ -808 +881 @@
 }
 
-
-
-char *ldb_dn_alloc_linearized(void *mem_ctx, struct ldb_dn *dn)
+/*
+  filter out all but an acceptable list of extended DN components
+ */
+void ldb_dn_extended_filter(struct ldb_dn *dn, const char * const *accept_list)
+{
+        unsigned int i;
+        for (i=0; i<dn->ext_comp_num; i++) {
+                if (!ldb_attr_in_list(accept_list, dn->ext_components[i].name)) {
+                        memmove(&dn->ext_components[i],
+                                &dn->ext_components[i+1],
+                                (dn->ext_comp_num-(i+1))*sizeof(dn->ext_components[0]));
+                        dn->ext_comp_num--;
+                        i--;
+                }
+        }
+        LDB_FREE(dn->ext_linearized);
+}
+
+
+char *ldb_dn_alloc_linearized(TALLOC_CTX *mem_ctx, struct ldb_dn *dn)
 {
         return talloc_strdup(mem_ctx, ldb_dn_get_linearized(dn));
@@ -822 +912 @@
 static bool ldb_dn_casefold_internal(struct ldb_dn *dn)
 {
-        int i, ret;
+        unsigned int i;
+        int ret;
 
         if ( ! dn || dn->invalid) return false;
@@ -867 +958 @@
 const char *ldb_dn_get_casefold(struct ldb_dn *dn)
 {
-        int i, len;
+        unsigned int i;
+        size_t len;
         char *d, *n;
 
@@ -924 +1016 @@
 }
 
-char *ldb_dn_alloc_casefold(void *mem_ctx, struct ldb_dn *dn)
+char *ldb_dn_alloc_casefold(TALLOC_CTX *mem_ctx, struct ldb_dn *dn)
 {
         return talloc_strdup(mem_ctx, ldb_dn_get_casefold(dn));
@@ -937 +1029 @@
 {
         int ret;
-        int n_base, n_dn;
+        unsigned int n_base, n_dn;
 
         if ( ! base || base->invalid) return 1;
@@ -973 +1065 @@
         }
 
-        if (dn->comp_num == 0) {
+        if ((dn->comp_num == 0) || (base->comp_num == 0)) {
                 if (dn->special && base->special) {
                         return strcmp(base->linearized, dn->linearized);
@@ -988 +1080 @@
         n_dn = dn->comp_num - 1;
 
-        while (n_base >= 0) {
+        while (n_base != (unsigned int) -1) {
                 char *b_name = base->components[n_base].cf_name;
                 char *dn_name = dn->components[n_dn].cf_name;
@@ -1023 +1115 @@
 int ldb_dn_compare(struct ldb_dn *dn0, struct ldb_dn *dn1)
 {
-        int i, ret;
+        unsigned int i;
+        int ret;
 
         if (( ! dn0) || dn0->invalid || ! dn1 || dn1->invalid) {
@@ -1094 +1187 @@
 
 static struct ldb_dn_component ldb_dn_copy_component(
-                                                void *mem_ctx,
+                                                TALLOC_CTX *mem_ctx,
                                                 struct ldb_dn_component *src)
 {
@@ -1140 +1233 @@
 
 static struct ldb_dn_ext_component ldb_dn_ext_copy_component(
-                                                void *mem_ctx,
+                                                TALLOC_CTX *mem_ctx,
                                                 struct ldb_dn_ext_component *src)
 {
@@ -1165 +1258 @@
 }
 
-struct ldb_dn *ldb_dn_copy(void *mem_ctx, struct ldb_dn *dn)
+struct ldb_dn *ldb_dn_copy(TALLOC_CTX *mem_ctx, struct ldb_dn *dn)
 {
         struct ldb_dn *new_dn;
@@ -1181 +1274 @@
 
         if (dn->components) {
-                int i;
+                unsigned int i;
 
                 new_dn->components =
@@ -1204 +1297 @@
 
         if (dn->ext_components) {
-                int i;
+                unsigned int i;
 
                 new_dn->ext_components =
@@ -1270 +1363 @@
 
         if (dn->components) {
-                int i;
+                unsigned int i;
 
                 if ( ! ldb_dn_validate(base)) {
@@ -1288 +1381 @@
                                                 dn->comp_num + base->comp_num);
                 if ( ! dn->components) {
-                        dn->invalid = true;
+                        ldb_dn_mark_invalid(dn);
                         return false;
                 }
@@ -1297 +1390 @@
                                                         &base->components[i]);
                         if (dn->components[dn->comp_num].value.data == NULL) {
-                                dn->invalid = true;
+                                ldb_dn_mark_invalid(dn);
                                 return false;
                         }
@@ -1328 +1421 @@
                 }
                 if ( ! t) {
-                        dn->invalid = true;
+                        ldb_dn_mark_invalid(dn);
                         return false;
                 }
@@ -1337 +1430 @@
         /* Wipe the ext_linearized DN,
          * the GUID and SID are almost certainly no longer valid */
-        if (dn->ext_linearized) {
-                LDB_FREE(dn->ext_linearized);
-        }
-
+        LDB_FREE(dn->ext_linearized);
         LDB_FREE(dn->ext_components);
         dn->ext_comp_num = 0;
+
         return true;
 }
@@ -1394 +1485 @@
 
         if (dn->components) {
-                int n, i, j;
+                unsigned int n;
+                unsigned int i, j;
+
+                if (dn->comp_num == 0) {
+                        return false;
+                }
 
                 if ( ! ldb_dn_validate(child)) {
@@ -1414 +1510 @@
                                                 n);
                 if ( ! dn->components) {
-                        dn->invalid = true;
+                        ldb_dn_mark_invalid(dn);
                         return false;
                 }
 
-                for (i = dn->comp_num - 1, j = n - 1; i >= 0; i--, j--) {
+                for (i = dn->comp_num - 1, j = n - 1; i != (unsigned int) -1;
+                     i--, j--) {
                         dn->components[j] = dn->components[i];
                 }
@@ -1427 +1524 @@
                                                         &child->components[i]);
                         if (dn->components[i].value.data == NULL) {
-                                dn->invalid = true;
+                                ldb_dn_mark_invalid(dn);
                                 return false;
                         }
@@ -1442 +1539 @@
 
         if (dn->linearized) {
+                if (dn->linearized[0] == '\0') {
+                        return false;
+                }
 
                 s = ldb_dn_get_linearized(child);
@@ -1450 +1550 @@
                 t = talloc_asprintf(dn, "%s,%s", s, dn->linearized);
                 if ( ! t) {
-                        dn->invalid = true;
+                        ldb_dn_mark_invalid(dn);
                         return false;
                 }
@@ -1460 +1560 @@
          * the GUID and SID are almost certainly no longer valid */
         LDB_FREE(dn->ext_linearized);
-
         LDB_FREE(dn->ext_components);
         dn->ext_comp_num = 0;
@@ -1502 +1601 @@
 bool ldb_dn_remove_base_components(struct ldb_dn *dn, unsigned int num)
 {
-        int i;
+        unsigned int i;
 
         if ( ! ldb_dn_validate(dn)) {
@@ -1513 +1612 @@
 
         /* free components */
-        for (i = num; i > 0; i--) {
-                LDB_FREE(dn->components[dn->comp_num - i].name);
-                LDB_FREE(dn->components[dn->comp_num - i].value.data);
-                LDB_FREE(dn->components[dn->comp_num - i].cf_name);
-                LDB_FREE(dn->components[dn->comp_num - i].cf_value.data);
+        for (i = dn->comp_num - num; i < dn->comp_num; i++) {
+                LDB_FREE(dn->components[i].name);
+                LDB_FREE(dn->components[i].value.data);
+                LDB_FREE(dn->components[i].cf_name);
+                LDB_FREE(dn->components[i].cf_value.data);
         }
 
@@ -1536 +1635 @@
          * the GUID and SID are almost certainly no longer valid */
         LDB_FREE(dn->ext_linearized);
-
         LDB_FREE(dn->ext_components);
         dn->ext_comp_num = 0;
@@ -1545 +1643 @@
 bool ldb_dn_remove_child_components(struct ldb_dn *dn, unsigned int num)
 {
-        int i, j;
+        unsigned int i, j;
 
         if ( ! ldb_dn_validate(dn)) {
@@ -1581 +1679 @@
          * the GUID and SID are almost certainly no longer valid */
         LDB_FREE(dn->ext_linearized);
-
         LDB_FREE(dn->ext_components);
         dn->ext_comp_num = 0;
+
         return true;
 }
 
-struct ldb_dn *ldb_dn_get_parent(void *mem_ctx, struct ldb_dn *dn)
+struct ldb_dn *ldb_dn_get_parent(TALLOC_CTX *mem_ctx, struct ldb_dn *dn)
 {
         struct ldb_dn *new_dn;
@@ -1601 +1699 @@
         }
 
-        /* Wipe the ext_linearized DN,
-         * the GUID and SID are almost certainly no longer valid */
-        LDB_FREE(dn->ext_linearized);
-
-        LDB_FREE(dn->ext_components);
-        dn->ext_comp_num = 0;
         return new_dn;
 }
@@ -1619 +1711 @@
 
 */
-static char *ldb_dn_canonical(void *mem_ctx, struct ldb_dn *dn, int ex_format) {
-        int i;
+static char *ldb_dn_canonical(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, int ex_format) {
+        unsigned int i;
         TALLOC_CTX *tmpctx;
         char *cracked = NULL;
@@ -1632 +1724 @@
 
         /* Walk backwards down the DN, grabbing 'dc' components at first */
-        for (i = dn->comp_num - 1 ; i >= 0; i--) {
+        for (i = dn->comp_num - 1; i != (unsigned int) -1; i--) {
                 if (ldb_attr_cmp(dn->components[i].name, "dc") != 0) {
                         break;
@@ -1651 +1743 @@
 
         /* Only domain components?  Finish here */
-        if (i < 0) {
+        if (i == (unsigned int) -1) {
                 cracked = talloc_strdup_append_buffer(cracked, format);
                 talloc_steal(mem_ctx, cracked);
@@ -1679 +1771 @@
 
 /* Wrapper functions for the above, for the two different string formats */
-char *ldb_dn_canonical_string(void *mem_ctx, struct ldb_dn *dn) {
+char *ldb_dn_canonical_string(TALLOC_CTX *mem_ctx, struct ldb_dn *dn) {
         return ldb_dn_canonical(mem_ctx, dn, 0);
 
 }
 
-char *ldb_dn_canonical_ex_string(void *mem_ctx, struct ldb_dn *dn) {
+char *ldb_dn_canonical_ex_string(TALLOC_CTX *mem_ctx, struct ldb_dn *dn) {
         return ldb_dn_canonical(mem_ctx, dn, 1);
 }
@@ -1694 +1786 @@
         }
         return dn->comp_num;
+}
+
+int ldb_dn_get_extended_comp_num(struct ldb_dn *dn)
+{
+        if ( ! ldb_dn_validate(dn)) {
+                return -1;
+        }
+        return dn->ext_comp_num;
 }
 
@@ -1765 +1865 @@
 
         if (dn->valid_case) {
-                int i;
+                unsigned int i;
                 for (i = 0; i < dn->comp_num; i++) {
                         LDB_FREE(dn->components[i].cf_name);
@@ -1778 +1878 @@
          * the GUID and SID are almost certainly no longer valid */
         LDB_FREE(dn->ext_linearized);
-
+        LDB_FREE(dn->ext_components);
         dn->ext_comp_num = 0;
-        LDB_FREE(dn->ext_components);
+
         return LDB_SUCCESS;
 }
@@ -1787 +1887 @@
                                                     const char *name)
 {
-        int i;
+        unsigned int i;
         if ( ! ldb_dn_validate(dn)) {
                 return NULL;
@@ -1803 +1903 @@
 {
         struct ldb_dn_ext_component *p;
-        int i;
+        unsigned int i;
+        struct ldb_val v2;
 
         if ( ! ldb_dn_validate(dn)) {
                 return LDB_ERR_OTHER;
+        }
+
+        if (!ldb_dn_extended_syntax_by_name(dn->ldb, name)) {
+                /* We don't know how to handle this type of thing */
+                return LDB_ERR_INVALID_DN_SYNTAX;
         }
 
@@ -1819 +1925 @@
                                 if (!dn->ext_components[i].name ||
                                     !dn->ext_components[i].value.data) {
-                                        dn->invalid = true;
+                                        ldb_dn_mark_invalid(dn);
                                         return LDB_ERR_OPERATIONS_ERROR;
                                 }
-
                         } else {
                                 if (i != (dn->ext_comp_num - 1)) {
@@ -1837 +1942 @@
                                                    dn->ext_comp_num);
                                 if (!dn->ext_components) {
-                                        dn->invalid = true;
+                                        ldb_dn_mark_invalid(dn);
                                         return LDB_ERR_OPERATIONS_ERROR;
                                 }
-                                return LDB_SUCCESS;
-                        }
-                }
-        }
+                        }
+                        LDB_FREE(dn->ext_linearized);
+
+                        return LDB_SUCCESS;
+                }
+        }
+
+        if (val == NULL) {
+                /* removing a value that doesn't exist is not an error */
+                return LDB_SUCCESS;
+        }
+
+        v2 = *val;
 
         p = dn->ext_components
@@ -1851 +1965 @@
                                  dn->ext_comp_num + 1);
         if (!dn->ext_components) {
-                dn->invalid = true;
+                ldb_dn_mark_invalid(dn);
                 return LDB_ERR_OPERATIONS_ERROR;
         }
 
-        p[dn->ext_comp_num].value = ldb_val_dup(dn->ext_components, val);
+        p[dn->ext_comp_num].value = ldb_val_dup(dn->ext_components, &v2);
         p[dn->ext_comp_num].name = talloc_strdup(p, name);
 
         if (!dn->ext_components[i].name || !dn->ext_components[i].value.data) {
-                dn->invalid = true;
+                ldb_dn_mark_invalid(dn);
                 return LDB_ERR_OPERATIONS_ERROR;
         }
@@ -1865 +1979 @@
         dn->ext_comp_num++;
 
+        LDB_FREE(dn->ext_linearized);
+
         return LDB_SUCCESS;
 }
@@ -1870 +1986 @@
 void ldb_dn_remove_extended_components(struct ldb_dn *dn)
 {
+        LDB_FREE(dn->ext_linearized);
+        LDB_FREE(dn->ext_components);
         dn->ext_comp_num = 0;
-        LDB_FREE(dn->ext_components);
 }
 
@@ -1906 +2023 @@
         return false;
 }
+
+/*
+  this updates dn->components, taking the components from ref_dn.
+  This is used by code that wants to update the DN path of a DN
+  while not impacting on the extended DN components
+ */
+int ldb_dn_update_components(struct ldb_dn *dn, const struct ldb_dn *ref_dn)
+{
+        dn->components = talloc_realloc(dn, dn->components,
+                                        struct ldb_dn_component, ref_dn->comp_num);
+        if (!dn->components) {
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+        memcpy(dn->components, ref_dn->components,
+               sizeof(struct ldb_dn_component)*ref_dn->comp_num);
+        dn->comp_num = ref_dn->comp_num;
+
+        LDB_FREE(dn->casefold);
+        LDB_FREE(dn->linearized);
+        LDB_FREE(dn->ext_linearized);
+
+        return LDB_SUCCESS;
+}
+
+/*
+  minimise a DN. The caller must pass in a validated DN.
+
+  If the DN has an extended component then only the first extended
+  component is kept, the DN string is stripped.
+
+  The existing dn is modified
+ */
+bool ldb_dn_minimise(struct ldb_dn *dn)
+{
+        unsigned int i;
+
+        if (!ldb_dn_validate(dn)) {
+                return false;
+        }
+        if (dn->ext_comp_num == 0) {
+                return true;
+        }
+
+        /* free components */
+        for (i = 0; i < dn->comp_num; i++) {
+                LDB_FREE(dn->components[i].name);
+                LDB_FREE(dn->components[i].value.data);
+                LDB_FREE(dn->components[i].cf_name);
+                LDB_FREE(dn->components[i].cf_value.data);
+        }
+        dn->comp_num = 0;
+        dn->valid_case = false;
+
+        LDB_FREE(dn->casefold);
+        LDB_FREE(dn->linearized);
+
+        /* note that we don't free dn->components as this there are
+         * several places in ldb_dn.c that rely on it being non-NULL
+         * for an exploded DN
+         */
+
+        for (i = 1; i < dn->ext_comp_num; i++) {
+                LDB_FREE(dn->ext_components[i].name);
+                LDB_FREE(dn->ext_components[i].value.data);
+        }
+        dn->ext_comp_num = 1;
+
+        dn->ext_components = talloc_realloc(dn, dn->ext_components, struct ldb_dn_ext_component, 1);
+        if (dn->ext_components == NULL) {
+                ldb_dn_mark_invalid(dn);
+                return false;
+        }
+
+        LDB_FREE(dn->ext_linearized);
+
+        return true;
+}

trunk/server/source4/lib/ldb/common/ldb_ldif.c

@@ -42 +42 @@
   
 */
-static int ldb_read_data_file(void *mem_ctx, struct ldb_val *value)
+static int ldb_read_data_file(TALLOC_CTX *mem_ctx, struct ldb_val *value)
 {
         struct stat statbuf;
@@ -151 +151 @@
   caller frees
 */
-char *ldb_base64_encode(void *mem_ctx, const char *buf, int len)
+char *ldb_base64_encode(TALLOC_CTX *mem_ctx, const char *buf, int len)
 {
         const char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
@@ -191 +191 @@
         uint8_t *p = val->data;
 
-        if (ldb->flags & LDB_FLG_SHOW_BINARY) {
-                return 0;
-        }
-
         if (val->length == 0) {
                 return 0;
@@ -220 +216 @@
                         const char *buf, size_t length, int start_pos)
 {
-        unsigned int i;
+        size_t i;
         int total=0, ret;
 
@@ -334 +330 @@
                 for (j=0;j<msg->elements[i].num_values;j++) {
                         struct ldb_val v;
+                        bool use_b64_encode;
                         ret = a->syntax->ldif_write_fn(ldb, mem_ctx, &msg->elements[i].values[j], &v);
                         if (ret != LDB_SUCCESS) {
                                 v = msg->elements[i].values[j];
                         }
-                        if (ret != LDB_SUCCESS || ldb_should_b64_encode(ldb, &v)) {
+                        use_b64_encode = !(ldb->flags & LDB_FLG_SHOW_BINARY)
+                                        && ldb_should_b64_encode(ldb, &v);
+                        if (ret != LDB_SUCCESS || use_b64_encode) {
                                 ret = fprintf_fn(private_data, "%s:: ", 
                                                  msg->elements[i].name);
@@ -374 +373 @@
         CHECK_RET;
 
+        talloc_free(mem_ctx);
+
         return total;
 }
@@ -448 +449 @@
 
 /* simple ldif attribute parser */
-static int next_attr(void *mem_ctx, char **s, const char **attr, struct ldb_val *value)
+static int next_attr(TALLOC_CTX *mem_ctx, char **s, const char **attr, struct ldb_val *value)
 {
         char *p;
@@ -509 +510 @@
                 int len = ldb_read_data_file(mem_ctx, value);
                 if (len == -1) {
-                        /* an error occured hile trying to retrieve the file */
+                        /* an error occurred while trying to retrieve the file */
                         return -1;
                 }

trunk/server/source4/lib/ldb/common/ldb_match.c

@@ -82 +82 @@
                              const struct ldb_message *msg,
                              const struct ldb_parse_tree *tree,
-                             enum ldb_scope scope)
-{
+                             enum ldb_scope scope, bool *matched)
+{
+        const struct ldb_schema_attribute *a;
+        struct ldb_message_element *el;
+
         if (ldb_attr_dn(tree->u.present.attr) == 0) {
-                return 1;
-        }
-
-        if (ldb_msg_find_element(msg, tree->u.present.attr)) {
-                return 1;
-        }
-
-        return 0;
+                *matched = true;
+                return LDB_SUCCESS;
+        }
+
+        el = ldb_msg_find_element(msg, tree->u.present.attr);
+        if (el == NULL) {
+                *matched = false;
+                return LDB_SUCCESS;
+        }
+
+        a = ldb_schema_attribute_by_name(ldb, el->name);
+        if (!a) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+
+        if (a->syntax->operator_fn) {
+                unsigned int i;
+                for (i = 0; i < el->num_values; i++) {
+                        int ret = a->syntax->operator_fn(ldb, LDB_OP_PRESENT, a, &el->values[i], NULL, matched);
+                        if (ret != LDB_SUCCESS) return ret;
+                        if (*matched) return LDB_SUCCESS;
+                }
+                *matched = false;
+                return LDB_SUCCESS;
+        }
+
+        *matched = true;
+        return LDB_SUCCESS;
 }
 
@@ -99 +122 @@
                                 const struct ldb_parse_tree *tree,
                                 enum ldb_scope scope,
-                                enum ldb_parse_op comp_op)
+                                enum ldb_parse_op comp_op, bool *matched)
 {
         unsigned int i;
         struct ldb_message_element *el;
         const struct ldb_schema_attribute *a;
-        int ret;
 
         /* FIXME: APPROX comparison not handled yet */
-        if (comp_op == LDB_OP_APPROX) return 0;
+        if (comp_op == LDB_OP_APPROX) {
+                return LDB_ERR_INAPPROPRIATE_MATCHING;
+        }
 
         el = ldb_msg_find_element(msg, tree->u.comparison.attr);
         if (el == NULL) {
-                return 0;
+                *matched = false;
+                return LDB_SUCCESS;
         }
 
         a = ldb_schema_attribute_by_name(ldb, el->name);
+        if (!a) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
 
         for (i = 0; i < el->num_values; i++) {
-                ret = a->syntax->comparison_fn(ldb, ldb, &el->values[i], &tree->u.comparison.value);
-
-                if (ret == 0) {
-                        return 1;
-                }
-                if (ret > 0 && comp_op == LDB_OP_GREATER) {
-                        return 1;
-                }
-                if (ret < 0 && comp_op == LDB_OP_LESS) {
-                        return 1;
-                }
-        }
-
-        return 0;
+                if (a->syntax->operator_fn) {
+                        int ret;
+                        ret = a->syntax->operator_fn(ldb, comp_op, a, &el->values[i], &tree->u.comparison.value, matched);
+                        if (ret != LDB_SUCCESS) return ret;
+                        if (*matched) return LDB_SUCCESS;
+                } else {
+                        int ret = a->syntax->comparison_fn(ldb, ldb, &el->values[i], &tree->u.comparison.value);
+
+                        if (ret == 0) {
+                                *matched = true;
+                                return LDB_SUCCESS;
+                        }
+                        if (ret > 0 && comp_op == LDB_OP_GREATER) {
+                                *matched = true;
+                                return LDB_SUCCESS;
+                        }
+                        if (ret < 0 && comp_op == LDB_OP_LESS) {
+                                *matched = true;
+                                return LDB_SUCCESS;
+                        }
+                }
+        }
+
+        *matched = false;
+        return LDB_SUCCESS;
 }
 
@@ -139 +178 @@
                               const struct ldb_message *msg,
                               const struct ldb_parse_tree *tree,
-                              enum ldb_scope scope)
+                              enum ldb_scope scope,
+                              bool *matched)
 {
         unsigned int i;
@@ -150 +190 @@
                 valuedn = ldb_dn_from_ldb_val(ldb, ldb, &tree->u.equality.value);
                 if (valuedn == NULL) {
-                        return 0;
+                        return LDB_ERR_INVALID_DN_SYNTAX;
                 }
 
@@ -157 +197 @@
                 talloc_free(valuedn);
 
-                if (ret == 0) return 1;
-                return 0;
+                *matched = (ret == 0);
+                return LDB_SUCCESS;
         }
 
@@ -165 +205 @@
         el = ldb_msg_find_element(msg, tree->u.equality.attr);
         if (el == NULL) {
-                return 0;
+                *matched = false;
+                return LDB_SUCCESS;
         }
 
         a = ldb_schema_attribute_by_name(ldb, el->name);
+        if (a == NULL) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
 
         for (i=0;i<el->num_values;i++) {
-                if (a->syntax->comparison_fn(ldb, ldb, &tree->u.equality.value, 
-                                             &el->values[i]) == 0) {
-                        return 1;
-                }
-        }
-
-        return 0;
+                if (a->syntax->operator_fn) {
+                        ret = a->syntax->operator_fn(ldb, LDB_OP_EQUALITY, a,
+                                                     &tree->u.equality.value, &el->values[i], matched);
+                        if (ret != LDB_SUCCESS) return ret;
+                        if (*matched) return LDB_SUCCESS;
+                } else {
+                        if (a->syntax->comparison_fn(ldb, ldb, &tree->u.equality.value,
+                                                     &el->values[i]) == 0) {
+                                *matched = true;
+                                return LDB_SUCCESS;
+                        }
+                }
+        }
+
+        *matched = false;
+        return LDB_SUCCESS;
 }
 
 static int ldb_wildcard_compare(struct ldb_context *ldb,
                                 const struct ldb_parse_tree *tree,
-                                const struct ldb_val value)
+                                const struct ldb_val value, bool *matched)
 {
         const struct ldb_schema_attribute *a;
@@ -190 +243 @@
         char *p, *g;
         uint8_t *save_p = NULL;
-        int c = 0;
+        unsigned int c = 0;
 
         a = ldb_schema_attribute_by_name(ldb, tree->u.substring.attr);
-
-        if(a->syntax->canonicalise_fn(ldb, ldb, &value, &val) != 0)
-                return -1;
+        if (!a) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+
+        if (a->syntax->canonicalise_fn(ldb, ldb, &value, &val) != 0) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
 
         save_p = val.data;
@@ -203 +260 @@
 
                 chunk = tree->u.substring.chunks[c];
-                if(a->syntax->canonicalise_fn(ldb, ldb, chunk, &cnk) != 0) goto failed;
+                if (a->syntax->canonicalise_fn(ldb, ldb, chunk, &cnk) != 0) goto mismatch;
 
                 /* This deals with wildcard prefix searches on binary attributes (eg objectGUID) */
                 if (cnk.length > val.length) {
-                        goto failed;
-                }
-                if (memcmp((char *)val.data, (char *)cnk.data, cnk.length) != 0) goto failed;
+                        goto mismatch;
+                }
+                if (memcmp((char *)val.data, (char *)cnk.data, cnk.length) != 0) goto mismatch;
                 val.length -= cnk.length;
                 val.data += cnk.length;
@@ -220 +277 @@
 
                 chunk = tree->u.substring.chunks[c];
-                if(a->syntax->canonicalise_fn(ldb, ldb, chunk, &cnk) != 0) goto failed;
+                if(a->syntax->canonicalise_fn(ldb, ldb, chunk, &cnk) != 0) goto mismatch;
 
                 /* FIXME: case of embedded nulls */
                 p = strstr((char *)val.data, (char *)cnk.data);
-                if (p == NULL) goto failed;
+                if (p == NULL) goto mismatch;
                 if ( (! tree->u.substring.chunks[c + 1]) && (! tree->u.substring.end_with_wildcard) ) {
                         do { /* greedy */
@@ -238 +295 @@
         }
 
-        if ( (! tree->u.substring.end_with_wildcard) && (*(val.data) != 0) ) goto failed; /* last chunk have not reached end of string */
+        /* last chunk may not have reached end of string */
+        if ( (! tree->u.substring.end_with_wildcard) && (*(val.data) != 0) ) goto mismatch;
         talloc_free(save_p);
-        return 1;
-
-failed:
+        *matched = true;
+        return LDB_SUCCESS;
+
+mismatch:
+        *matched = false;
         talloc_free(save_p);
         talloc_free(cnk.data);
-        return 0;
+        return LDB_SUCCESS;
 }
 
@@ -254 +314 @@
                                const struct ldb_message *msg,
                                const struct ldb_parse_tree *tree,
-                               enum ldb_scope scope)
+                               enum ldb_scope scope, bool *matched)
 {
         unsigned int i;
@@ -261 +321 @@
         el = ldb_msg_find_element(msg, tree->u.substring.attr);
         if (el == NULL) {
-                return 0;
+                *matched = false;
+                return LDB_SUCCESS;
         }
 
         for (i = 0; i < el->num_values; i++) {
-                if (ldb_wildcard_compare(ldb, tree, el->values[i]) == 1) {
-                        return 1;
-                }
-        }
-
-        return 0;
+                int ret;
+                ret = ldb_wildcard_compare(ldb, tree, el->values[i], matched);
+                if (ret != LDB_SUCCESS) return ret;
+                if (*matched) return LDB_SUCCESS;
+        }
+
+        *matched = false;
+        return LDB_SUCCESS;
 }
 
@@ -277 +340 @@
   bitwise-and comparator
 */
-static int ldb_comparator_and(const struct ldb_val *v1, const struct ldb_val *v2)
+static int ldb_comparator_bitmask(const char *oid, const struct ldb_val *v1, const struct ldb_val *v2,
+                                  bool *matched)
 {
         uint64_t i1, i2;
-        i1 = strtoull((char *)v1->data, NULL, 0);
-        i2 = strtoull((char *)v2->data, NULL, 0);
-        return ((i1 & i2) == i2);
-}
-
-/*
-  bitwise-or comparator
-*/
-static int ldb_comparator_or(const struct ldb_val *v1, const struct ldb_val *v2)
-{
-        uint64_t i1, i2;
-        i1 = strtoull((char *)v1->data, NULL, 0);
-        i2 = strtoull((char *)v2->data, NULL, 0);
-        return ((i1 & i2) != 0);
+        char ibuf[100];
+        char *endptr = NULL;
+
+        if (v1->length >= sizeof(ibuf)-1) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        memcpy(ibuf, (char *)v1->data, v1->length);
+        ibuf[v1->length] = 0;
+        i1 = strtoull(ibuf, &endptr, 0);
+        if (endptr != NULL) {
+                if (endptr == ibuf || *endptr != 0) {
+                        return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+                }
+        }
+
+        if (v2->length >= sizeof(ibuf)-1) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        endptr = NULL;
+        memcpy(ibuf, (char *)v2->data, v2->length);
+        ibuf[v2->length] = 0;
+        i2 = strtoull(ibuf, &endptr, 0);
+        if (endptr != NULL) {
+                if (endptr == ibuf || *endptr != 0) {
+                        return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+                }
+        }
+        if (strcmp(LDB_OID_COMPARATOR_AND, oid) == 0) {
+                *matched = ((i1 & i2) == i2);
+        } else if (strcmp(LDB_OID_COMPARATOR_OR, oid) == 0) {
+                *matched = ((i1 & i2) != 0);
+        } else {
+                return LDB_ERR_INAPPROPRIATE_MATCHING;
+        }
+        return LDB_SUCCESS;
 }
 
@@ -303 +388 @@
                               const struct ldb_message *msg,
                               const struct ldb_parse_tree *tree,
-                              enum ldb_scope scope)
-{
-        int i;
+                              enum ldb_scope scope, bool *matched)
+{
+        unsigned int i;
         const struct {
                 const char *oid;
-                int (*comparator)(const struct ldb_val *, const struct ldb_val *);
+                int (*comparator)(const char *, const struct ldb_val *, const struct ldb_val *, bool *);
         } rules[] = {
-                { LDB_OID_COMPARATOR_AND, ldb_comparator_and},
-                { LDB_OID_COMPARATOR_OR, ldb_comparator_or}
+                { LDB_OID_COMPARATOR_AND, ldb_comparator_bitmask},
+                { LDB_OID_COMPARATOR_OR, ldb_comparator_bitmask}
         };
-        int (*comp)(const struct ldb_val *, const struct ldb_val *) = NULL;
+        int (*comp)(const char *,const struct ldb_val *, const struct ldb_val *, bool *) = NULL;
         struct ldb_message_element *el;
 
         if (tree->u.extended.dnAttributes) {
-                ldb_debug(ldb, LDB_DEBUG_ERROR, "ldb: dnAttributes extended match not supported yet");
-                return -1;
+                /* FIXME: We really need to find out what this ":dn" part in
+                 * an extended match means and how to handle it. For now print
+                 * only a warning to have s3 winbind and other tools working
+                 * against us. - Matthias */
+                ldb_debug(ldb, LDB_DEBUG_WARNING, "ldb: dnAttributes extended match not supported yet");
         }
         if (tree->u.extended.rule_id == NULL) {
                 ldb_debug(ldb, LDB_DEBUG_ERROR, "ldb: no-rule extended matches not supported yet");
-                return -1;
+                return LDB_ERR_INAPPROPRIATE_MATCHING;
         }
         if (tree->u.extended.attr == NULL) {
                 ldb_debug(ldb, LDB_DEBUG_ERROR, "ldb: no-attribute extended matches not supported yet");
-                return -1;
+                return LDB_ERR_INAPPROPRIATE_MATCHING;
         }
 
@@ -338 +426 @@
                 ldb_debug(ldb, LDB_DEBUG_ERROR, "ldb: unknown extended rule_id %s",
                           tree->u.extended.rule_id);
-                return -1;
+                return LDB_ERR_INAPPROPRIATE_MATCHING;
         }
 
@@ -344 +432 @@
         el = ldb_msg_find_element(msg, tree->u.extended.attr);
         if (el == NULL) {
-                return 0;
+                *matched = false;
+                return LDB_SUCCESS;
         }
 
         for (i=0;i<el->num_values;i++) {
-                int ret = comp(&el->values[i], &tree->u.extended.value);
-                if (ret == -1 || ret == 1) return ret;
-        }
-
-        return 0;
+                int ret = comp(tree->u.extended.rule_id, &el->values[i], &tree->u.extended.value, matched);
+                if (ret != LDB_SUCCESS) return ret;
+                if (*matched) return LDB_SUCCESS;
+        }
+
+        *matched = false;
+        return LDB_SUCCESS;
 }
 
@@ -366 +457 @@
                              const struct ldb_message *msg,
                              const struct ldb_parse_tree *tree,
-                             enum ldb_scope scope)
+                             enum ldb_scope scope, bool *matched)
 {
         unsigned int i;
-        int v;
+        int ret;
+
+        *matched = false;
 
         switch (tree->operation) {
         case LDB_OP_AND:
                 for (i=0;i<tree->u.list.num_elements;i++) {
-                        v = ldb_match_message(ldb, msg, tree->u.list.elements[i], scope);
-                        if (!v) return 0;
-                }
-                return 1;
+                        ret = ldb_match_message(ldb, msg, tree->u.list.elements[i], scope, matched);
+                        if (ret != LDB_SUCCESS) return ret;
+                        if (!*matched) return LDB_SUCCESS;
+                }
+                *matched = true;
+                return LDB_SUCCESS;
 
         case LDB_OP_OR:
                 for (i=0;i<tree->u.list.num_elements;i++) {
-                        v = ldb_match_message(ldb, msg, tree->u.list.elements[i], scope);
-                        if (v) return 1;
-                }
-                return 0;
+                        ret = ldb_match_message(ldb, msg, tree->u.list.elements[i], scope, matched);
+                        if (ret != LDB_SUCCESS) return ret;
+                        if (*matched) return LDB_SUCCESS;
+                }
+                *matched = false;
+                return LDB_SUCCESS;
 
         case LDB_OP_NOT:
-                return ! ldb_match_message(ldb, msg, tree->u.isnot.child, scope);
+                ret = ldb_match_message(ldb, msg, tree->u.isnot.child, scope, matched);
+                if (ret != LDB_SUCCESS) return ret;
+                *matched = ! *matched;
+                return LDB_SUCCESS;
 
         case LDB_OP_EQUALITY:
-                return ldb_match_equality(ldb, msg, tree, scope);
+                return ldb_match_equality(ldb, msg, tree, scope, matched);
 
         case LDB_OP_SUBSTRING:
-                return ldb_match_substring(ldb, msg, tree, scope);
+                return ldb_match_substring(ldb, msg, tree, scope, matched);
 
         case LDB_OP_GREATER:
-                return ldb_match_comparison(ldb, msg, tree, scope, LDB_OP_GREATER);
+                return ldb_match_comparison(ldb, msg, tree, scope, LDB_OP_GREATER, matched);
 
         case LDB_OP_LESS:
-                return ldb_match_comparison(ldb, msg, tree, scope, LDB_OP_LESS);
+                return ldb_match_comparison(ldb, msg, tree, scope, LDB_OP_LESS, matched);
 
         case LDB_OP_PRESENT:
-                return ldb_match_present(ldb, msg, tree, scope);
+                return ldb_match_present(ldb, msg, tree, scope, matched);
 
         case LDB_OP_APPROX:
-                return ldb_match_comparison(ldb, msg, tree, scope, LDB_OP_APPROX);
+                return ldb_match_comparison(ldb, msg, tree, scope, LDB_OP_APPROX, matched);
 
         case LDB_OP_EXTENDED:
-                return ldb_match_extended(ldb, msg, tree, scope);
-
-        }
-
-        return 0;
+                return ldb_match_extended(ldb, msg, tree, scope, matched);
+        }
+
+        return LDB_ERR_INAPPROPRIATE_MATCHING;
 }
 
@@ -421 +520 @@
                   enum ldb_scope scope)
 {
+        bool matched;
+        int ret;
+
         if ( ! ldb_match_scope(ldb, base, msg->dn, scope) ) {
                 return 0;
         }
 
-        return ldb_match_message(ldb, msg, tree, scope);
-}
+        ret = ldb_match_message(ldb, msg, tree, scope, &matched);
+        if (ret != LDB_SUCCESS) {
+                /* to match the old API, we need to consider this a
+                   failure to match */
+                return 0;
+        }
+        return matched?1:0;
+}
+
+int ldb_match_msg_error(struct ldb_context *ldb,
+                        const struct ldb_message *msg,
+                        const struct ldb_parse_tree *tree,
+                        struct ldb_dn *base,
+                        enum ldb_scope scope,
+                        bool *matched)
+{
+        if ( ! ldb_match_scope(ldb, base, msg->dn, scope) ) {
+                *matched = false;
+                return LDB_SUCCESS;
+        }
+
+        return ldb_match_message(ldb, msg, tree, scope, matched);
+}
+
+int ldb_match_msg_objectclass(const struct ldb_message *msg,
+                              const char *objectclass)
+{
+        unsigned int i;
+        struct ldb_message_element *el = ldb_msg_find_element(msg, "objectClass");
+        if (!el) {
+                return 0;
+        }
+        for (i=0; i < el->num_values; i++) {
+                if (ldb_attr_cmp((const char *)el->values[i].data, objectclass) == 0) {
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+
+                              

trunk/server/source4/lib/ldb/common/ldb_modules.c

@@ -34 +34 @@
 #include "ldb_private.h"
 #include "dlinklist.h"
-
-#define LDB_MODULE_PREFIX       "modules:"
-#define LDB_MODULE_PREFIX_LEN   8
-
-static void *ldb_dso_load_symbol(struct ldb_context *ldb, const char *name,
-                                 const char *symbol);
-
-void ldb_set_modules_dir(struct ldb_context *ldb, const char *path)
-{
-        talloc_free(ldb->modules_dir);
-        ldb->modules_dir = talloc_strdup(ldb, path);
-}
+#include "system/dir.h"
 
 static char *ldb_modules_strdup_no_spaces(TALLOC_CTX *mem_ctx, const char *string)
 {
-        int i, len;
+        size_t i, len;
         char *trimmed;
 
@@ -80 +69 @@
         const char **m;
         char *modstr, *p;
-        int i;
+        unsigned int i;
 
         /* spaces not admitted */
@@ -96 +85 @@
         }
         talloc_steal(modules, modstr);
+
+        if (modstr[0] == '\0') {
+                modules[0] = NULL;
+                m = (const char **)modules;
+                return m;
+        }
 
         i = 0;
@@ -131 +126 @@
 } *registered_modules = NULL;
 
-static const struct ldb_builtins {
-        const struct ldb_backend_ops *backend_ops;
-        const struct ldb_module_ops *module_ops;
-} builtins[];
-
-static ldb_connect_fn ldb_find_backend(const char *url)
+static struct backends_list_entry *ldb_find_backend(const char *url_prefix)
 {
         struct backends_list_entry *backend;
-        int i;
-
-        for (i = 0; builtins[i].backend_ops || builtins[i].module_ops; i++) {
-                if (builtins[i].backend_ops == NULL) continue;
-
-                if (strncmp(builtins[i].backend_ops->name, url,
-                            strlen(builtins[i].backend_ops->name)) == 0) {
-                        return builtins[i].backend_ops->connect_fn;
-                }
-        }
 
         for (backend = ldb_backends; backend; backend = backend->next) {
-                if (strncmp(backend->ops->name, url,
-                            strlen(backend->ops->name)) == 0) {
-                        return backend->ops->connect_fn;
+                if (strcmp(backend->ops->name, url_prefix) == 0) {
+                        return backend;
                 }
         }
@@ -161 +140 @@
 
 /*
- register a new ldb backend
+  register a new ldb backend
+
+  if override is true, then override any existing backend for this prefix
 */
-int ldb_register_backend(const char *url_prefix, ldb_connect_fn connectfn)
-{
-        struct ldb_backend_ops *backend;
-        struct backends_list_entry *entry;
-
-        backend = talloc(talloc_autofree_context(), struct ldb_backend_ops);
-        if (!backend) return LDB_ERR_OPERATIONS_ERROR;
-
-        entry = talloc(talloc_autofree_context(), struct backends_list_entry);
-        if (!entry) {
-                talloc_free(backend);
-                return LDB_ERR_OPERATIONS_ERROR;
-        }
-
-        if (ldb_find_backend(url_prefix)) {
-                return LDB_SUCCESS;
-        }
-
-        /* Maybe check for duplicity here later on? */
-
-        backend->name = talloc_strdup(backend, url_prefix);
-        backend->connect_fn = connectfn;
-        entry->ops = backend;
-        DLIST_ADD(ldb_backends, entry);
+int ldb_register_backend(const char *url_prefix, ldb_connect_fn connectfn, bool override)
+{
+        struct backends_list_entry *be;
+
+        be = ldb_find_backend(url_prefix);
+        if (be) {
+                if (!override) {
+                        return LDB_SUCCESS;
+                }
+        } else {
+                be = talloc_zero(ldb_backends, struct backends_list_entry);
+                if (!be) {
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
+                be->ops = talloc_zero(be, struct ldb_backend_ops);
+                if (!be->ops) {
+                        talloc_free(be);
+                        return LDB_ERR_OPERATIONS_ERROR;
+                }
+                DLIST_ADD_END(ldb_backends, be, struct backends_list_entry);
+        }
+
+        be->ops->name = url_prefix;
+        be->ops->connect_fn = connectfn;
 
         return LDB_SUCCESS;
@@ -205 +186 @@
    module may wish to direct certain requests at a particular backend.
 */
-int ldb_connect_backend(struct ldb_context *ldb,
-                        const char *url,
-                        const char *options[],
-                        struct ldb_module **backend_module)
+int ldb_module_connect_backend(struct ldb_context *ldb,
+                               const char *url,
+                               const char *options[],
+                               struct ldb_module **backend_module)
 {
         int ret;
         char *backend;
-        ldb_connect_fn fn;
+        struct backends_list_entry *be;
 
         if (strchr(url, ':') != NULL) {
@@ -221 +202 @@
         }
 
-        fn = ldb_find_backend(backend);
-
-        if (fn == NULL) {
-                struct ldb_backend_ops *ops;
-                char *symbol_name = talloc_asprintf(ldb, "ldb_%s_backend_ops", backend);
-                if (symbol_name == NULL) {
-                        return LDB_ERR_OPERATIONS_ERROR;
-                }
-                ops = ldb_dso_load_symbol(ldb, backend, symbol_name);
-                if (ops != NULL) {
-                        fn = ops->connect_fn;
-                }
-                talloc_free(symbol_name);
-        }
+        be = ldb_find_backend(backend);
 
         talloc_free(backend);
 
-        if (fn == NULL) {
+        if (be == NULL) {
                 ldb_debug(ldb, LDB_DEBUG_FATAL,
-                          "Unable to find backend for '%s'", url);
+                          "Unable to find backend for '%s' - do you need to set LDB_MODULES_PATH?", url);
                 return LDB_ERR_OTHER;
         }
 
-        ret = fn(ldb, url, ldb->flags, options, backend_module);
+        ret = be->ops->connect_fn(ldb, url, ldb->flags, options, backend_module);
 
         if (ret != LDB_SUCCESS) {
                 ldb_debug(ldb, LDB_DEBUG_ERROR,
-                          "Failed to connect to '%s'", url);
+                          "Failed to connect to '%s' with backend '%s'", url, be->ops->name);
                 return ret;
         }
@@ -254 +222 @@
 }
 
+static struct ldb_hooks {
+        struct ldb_hooks *next, *prev;
+        ldb_hook_fn hook_fn;
+} *ldb_hooks;
+
+/*
+  register a ldb hook function
+ */
+int ldb_register_hook(ldb_hook_fn hook_fn)
+{
+        struct ldb_hooks *lc;
+        lc = talloc_zero(ldb_hooks, struct ldb_hooks);
+        if (lc == NULL) {
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+        lc->hook_fn = hook_fn;
+        DLIST_ADD_END(ldb_hooks, lc, struct ldb_hooks);
+        return LDB_SUCCESS;
+}
+
+/*
+  call ldb hooks of a given type
+ */
+int ldb_modules_hook(struct ldb_context *ldb, enum ldb_module_hook_type t)
+{
+        struct ldb_hooks *lc;
+        for (lc = ldb_hooks; lc; lc=lc->next) {
+                int ret = lc->hook_fn(ldb, t);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+        return LDB_SUCCESS;
+}
+
+
 static const struct ldb_module_ops *ldb_find_module_ops(const char *name)
 {
         struct ops_list_entry *e;
-        int i;
-
-        for (i = 0; builtins[i].backend_ops || builtins[i].module_ops; i++) {
-                if (builtins[i].module_ops == NULL) continue;
-
-                if (strcmp(builtins[i].module_ops->name, name) == 0)
-                        return builtins[i].module_ops;
-        }
 
         for (e = registered_modules; e; e = e->next) {
@@ -277 +273 @@
 int ldb_register_module(const struct ldb_module_ops *ops)
 {
-        struct ops_list_entry *entry = talloc(talloc_autofree_context(), struct ops_list_entry);
+        struct ops_list_entry *entry;
 
         if (ldb_find_module_ops(ops->name) != NULL)
-                return -1;
-
+                return LDB_ERR_ENTRY_ALREADY_EXISTS;
+
+        entry = talloc(talloc_autofree_context(), struct ops_list_entry);
         if (entry == NULL)
                 return -1;
@@ -292 +289 @@
 }
 
-static void *ldb_dso_load_symbol(struct ldb_context *ldb, const char *name,
-                                 const char *symbol)
-{
-        char *path;
-        void *handle;
-        void *sym;
-
-        if (ldb->modules_dir == NULL)
-                return NULL;
-
-        path = talloc_asprintf(ldb, "%s/%s.%s", ldb->modules_dir, name,
-                               SHLIBEXT);
-
-        ldb_debug(ldb, LDB_DEBUG_TRACE, "trying to load %s from %s", name, path);
-
-        handle = dlopen(path, RTLD_NOW);
-        if (handle == NULL) {
-                ldb_debug(ldb, LDB_DEBUG_WARNING, "unable to load %s from %s: %s", name, path, dlerror());
-                return NULL;
-        }
-
-        sym = (int (*)(void))dlsym(handle, symbol);
-
-        if (sym == NULL) {
-                ldb_debug(ldb, LDB_DEBUG_ERROR, "no symbol `%s' found in %s: %s", symbol, path, dlerror());
-                return NULL;
-        }
-
-        talloc_free(path);
-
-        return sym;
-}
-
-int ldb_load_modules_list(struct ldb_context *ldb, const char **module_list, struct ldb_module *backend, struct ldb_module **out)
+/*
+  load a list of modules
+ */
+int ldb_module_load_list(struct ldb_context *ldb, const char **module_list,
+                         struct ldb_module *backend, struct ldb_module **out)
 {
         struct ldb_module *module;
-        int i;
+        unsigned int i;
 
         module = backend;
 
-        for (i = 0; module_list[i] != NULL; i++) {
+        for (i = 0; module_list && module_list[i] != NULL; i++) {
                 struct ldb_module *current;
                 const struct ldb_module_ops *ops;
@@ -341 +309 @@
 
                 ops = ldb_find_module_ops(module_list[i]);
+
                 if (ops == NULL) {
-                        char *symbol_name = talloc_asprintf(ldb, "ldb_%s_module_ops",
-                                                                                                module_list[i]);
-                        if (symbol_name == NULL) {
-                                return LDB_ERR_OPERATIONS_ERROR;
-                        }
-                        ops = ldb_dso_load_symbol(ldb, module_list[i], symbol_name);
-                        talloc_free(symbol_name);
-                }
-
-                if (ops == NULL) {
-                        ldb_debug(ldb, LDB_DEBUG_WARNING, "WARNING: Module [%s] not found",
+                        ldb_debug(ldb, LDB_DEBUG_FATAL, "WARNING: Module [%s] not found - do you need to set LDB_MODULES_PATH?",
                                   module_list[i]);
-                        continue;
+                        return LDB_ERR_OPERATIONS_ERROR;
                 }
 
@@ -372 +331 @@
 }
 
-int ldb_init_module_chain(struct ldb_context *ldb, struct ldb_module *module)
+/*
+  initialise a chain of modules
+ */
+int ldb_module_init_chain(struct ldb_context *ldb, struct ldb_module *module)
 {
         while (module && module->ops->init_context == NULL)
@@ -383 +345 @@
                 int ret = module->ops->init_context(module);
                 if (ret != LDB_SUCCESS) {
-                        ldb_debug(ldb, LDB_DEBUG_FATAL, "module %s initialization failed", module->ops->name);
+                        ldb_debug(ldb, LDB_DEBUG_FATAL, "module %s initialization failed : %s",
+                                  module->ops->name, ldb_strerror(ret));
                         return ret;
                 }
@@ -393 +356 @@
 int ldb_load_modules(struct ldb_context *ldb, const char *options[])
 {
+        const char *modules_string;
         const char **modules = NULL;
-        int i;
         int ret;
         TALLOC_CTX *mem_ctx = talloc_new(ldb);
@@ -405 +368 @@
         /* check if we have a custom module list passd as ldb option */
         if (options) {
-                for (i = 0; options[i] != NULL; i++) {
-                        if (strncmp(options[i], LDB_MODULE_PREFIX, LDB_MODULE_PREFIX_LEN) == 0) {
-                                modules = ldb_modules_list_from_string(ldb, mem_ctx, &options[i][LDB_MODULE_PREFIX_LEN]);
-                        }
+                modules_string = ldb_options_find(ldb, options, "modules");
+                if (modules_string) {
+                        modules = ldb_modules_list_from_string(ldb, mem_ctx, modules_string);
                 }
         }
@@ -454 +416 @@
 
         if (modules != NULL) {
-                ret = ldb_load_modules_list(ldb, modules, ldb->modules, &ldb->modules);
+                ret = ldb_module_load_list(ldb, modules, ldb->modules, &ldb->modules);
                 if (ret != LDB_SUCCESS) {
                         talloc_free(mem_ctx);
@@ -463 +425 @@
         }
 
-        ret = ldb_init_module_chain(ldb, ldb->modules);
+        ret = ldb_module_init_chain(ldb, ldb->modules);
         talloc_free(mem_ctx);
         return ret;
@@ -476 +438 @@
         module = module->next; \
         while (module && module->ops->op == NULL) module = module->next; \
+        if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { \
+                ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_trace_next_request: (%s)->" #op, \
+                          module->ops->name);                           \
+        }                                                               \
 } while (0)
 
@@ -516 +482 @@
 {
         return module->ldb;
+}
+
+const struct ldb_module_ops *ldb_module_get_ops(struct ldb_module *module)
+{
+        return module->ops;
 }
 
@@ -592 +563 @@
                  * corner for module developers to cut themselves on
                  */
-                ldb_module_done(request, NULL, NULL, ret);
+                ret = ldb_module_done(request, NULL, NULL, ret);
         }
         return ret;
@@ -601 +572 @@
         module = module->next;
 
-        return ldb_init_module_chain(module->ldb, module);
+        return ldb_module_init_chain(module->ldb, module);
 }
 
 int ldb_next_start_trans(struct ldb_module *module)
 {
+        int ret;
         FIND_OP(module, start_transaction);
-        return module->ops->start_transaction(module);
+        ret = module->ops->start_transaction(module);
+        if (ret == LDB_SUCCESS) {
+                return ret;
+        }
+        if (!ldb_errstring(module->ldb)) {
+                /* Set a default error string, to place the blame somewhere */
+                ldb_asprintf_errstring(module->ldb, "start_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret);
+        }
+        if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_start_trans error: %s", 
+                          ldb_errstring(module->ldb));                          
+        }
+        return ret;
 }
 
 int ldb_next_end_trans(struct ldb_module *module)
 {
+        int ret;
         FIND_OP(module, end_transaction);
-        return module->ops->end_transaction(module);
+        ret = module->ops->end_transaction(module);
+        if (ret == LDB_SUCCESS) {
+                return ret;
+        }
+        if (!ldb_errstring(module->ldb)) {
+                /* Set a default error string, to place the blame somewhere */
+                ldb_asprintf_errstring(module->ldb, "end_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret);
+        }
+        if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_end_trans error: %s", 
+                          ldb_errstring(module->ldb));                          
+        }
+        return ret;
 }
 
 int ldb_next_prepare_commit(struct ldb_module *module)
 {
+        int ret;
         FIND_OP_NOERR(module, prepare_commit);
         if (module == NULL) {
@@ -624 +622 @@
                 return LDB_SUCCESS;
         }
-        return module->ops->prepare_commit(module);
+        ret = module->ops->prepare_commit(module);
+        if (ret == LDB_SUCCESS) {
+                return ret;
+        }
+        if (!ldb_errstring(module->ldb)) {
+                /* Set a default error string, to place the blame somewhere */
+                ldb_asprintf_errstring(module->ldb, "prepare_commit error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret);
+        }
+        if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_prepare_commit error: %s", 
+                          ldb_errstring(module->ldb));                          
+        }
+        return ret;
 }
 
 int ldb_next_del_trans(struct ldb_module *module)
 {
+        int ret;
         FIND_OP(module, del_transaction);
-        return module->ops->del_transaction(module);
+        ret = module->ops->del_transaction(module);
+        if (ret == LDB_SUCCESS) {
+                return ret;
+        }
+        if (!ldb_errstring(module->ldb)) {
+                /* Set a default error string, to place the blame somewhere */
+                ldb_asprintf_errstring(module->ldb, "del_trans error in module %s: %s (%d)", module->ops->name, ldb_strerror(ret), ret);
+        }
+        if ((module && module->ldb->flags & LDB_FLG_ENABLE_TRACING)) { 
+                ldb_debug(module->ldb, LDB_DEBUG_TRACE, "ldb_next_del_trans error: %s", 
+                          ldb_errstring(module->ldb));                          
+        }
+        return ret;
 }
 
@@ -647 +670 @@
         h->ldb = ldb;
         h->flags = 0;
+        h->location = NULL;
+        h->parent = NULL;
 
         return h;
@@ -729 +754 @@
  *      ctrls: controls to send in the reply (must be a talloc pointer, steal)
  *      response: results for extended request (steal)
- *      error: LDB_SUCCESS for a succesful return
+ *      error: LDB_SUCCESS for a successful return
  *             any other ldb error otherwise
  */
@@ -763 +788 @@
         }
 
-        req->callback(req, ares);
-        return error;
+        return req->callback(req, ares);
 }
 
 /* to be used *only* in modules init functions.
- * this function i synchronous and will register
+ * this function is synchronous and will register
  * the requested OID in the rootdse module if present
  * otherwise it will return an error */
@@ -801 +825 @@
 }
 
-#ifndef STATIC_LIBLDB_MODULES
-
-#ifdef HAVE_LDB_LDAP
-#define LDAP_BACKEND LDB_BACKEND(ldap), LDB_BACKEND(ldapi), LDB_BACKEND(ldaps),
-#else
-#define LDAP_BACKEND
+static int ldb_modules_load_dir(const char *modules_dir, const char *version);
+
+
+/*
+  load one module. A static list of loaded module inode numbers is
+  used to prevent a module being loaded twice
+
+  dlopen() is used on the module, and dlsym() is then used to look for
+  a ldb_init_module() function. If present, that function is called
+  with the ldb version number as an argument.
+
+  The ldb_init_module() function will typically call
+  ldb_register_module() and ldb_register_backend() to register a
+  module or backend, but it may also be used to register command line
+  handling functions, ldif handlers or any other local
+  modififications.
+
+  The ldb_init_module() function does not get a ldb_context passed in,
+  as modules will be used for multiple ldb context handles. The call
+  from the first ldb_init() is just a convenient way to ensure it is
+  called early enough.
+ */
+static int ldb_modules_load_path(const char *path, const char *version)
+{
+        void *handle;
+        int (*init_fn)(const char *);
+        int ret;
+        struct stat st;
+        static struct loaded {
+                struct loaded *next, *prev;
+                ino_t st_ino;
+                dev_t st_dev;
+        } *loaded;
+        struct loaded *le;
+        int dlopen_flags;
+
+        ret = stat(path, &st);
+        if (ret != 0) {
+                fprintf(stderr, "ldb: unable to stat module %s : %s\n", path, strerror(errno));
+                return LDB_ERR_UNAVAILABLE;
+        }
+
+        for (le=loaded; le; le=le->next) {
+                if (le->st_ino == st.st_ino &&
+                    le->st_dev == st.st_dev) {
+                        /* its already loaded */
+                        return LDB_SUCCESS;
+                }
+        }
+
+        le = talloc(loaded, struct loaded);
+        if (le == NULL) {
+                fprintf(stderr, "ldb: unable to allocated loaded entry\n");
+                return LDB_ERR_UNAVAILABLE;
+        }
+
+        le->st_ino = st.st_ino;
+        le->st_dev = st.st_dev;
+
+        DLIST_ADD_END(loaded, le, struct loaded);
+
+        /* if it is a directory, recurse */
+        if (S_ISDIR(st.st_mode)) {
+                return ldb_modules_load_dir(path, version);
+        }
+
+        dlopen_flags = RTLD_NOW;
+#ifdef RTLD_DEEPBIND
+        /* use deepbind if possible, to avoid issues with different
+           system library varients, for example ldb modules may be linked
+           against Heimdal while the application may use MIT kerberos
+
+           See the dlopen manpage for details
+        */
+        dlopen_flags |= RTLD_DEEPBIND;
 #endif
 
-#ifdef HAVE_LDB_SQLITE3
-#define SQLITE3_BACKEND LDB_BACKEND(sqlite3),
-#else
-#define SQLITE3_BACKEND
-#endif
-
-#define STATIC_LIBLDB_MODULES \
-        LDB_BACKEND(tdb),       \
-        LDAP_BACKEND    \
-        SQLITE3_BACKEND \
-        LDB_MODULE(rdn_name),   \
-        LDB_MODULE(paged_results),      \
-        LDB_MODULE(server_sort),                \
-        LDB_MODULE(asq), \
-        NULL
-#endif
-
-/*
- * this is a bit hacked, as STATIC_LIBLDB_MODULES contains ','
- * between the elements and we want to autogenerate the
- * extern struct declarations, so we do some hacks and let the
- * ',' appear in an unused function prototype.
- */
-#undef NULL
-#define NULL LDB_MODULE(NULL),
-
-#define LDB_BACKEND(name) \
-        int); \
-        extern const struct ldb_backend_ops ldb_ ## name ## _backend_ops;\
-        extern void ldb_noop ## name (int
-#define LDB_MODULE(name) \
-        int); \
-        extern const struct ldb_module_ops ldb_ ## name ## _module_ops;\
-        extern void ldb_noop ## name (int
-
-extern void ldb_start_noop(int,
-STATIC_LIBLDB_MODULES
-int);
-
-#undef NULL
-#define NULL { \
-        .backend_ops = (void *)0, \
-        .module_ops = (void *)0 \
-}
-
-#undef LDB_BACKEND
-#define LDB_BACKEND(name) { \
-        .backend_ops = &ldb_ ## name ## _backend_ops, \
-        .module_ops = (void *)0 \
-}
-#undef LDB_MODULE
-#define LDB_MODULE(name) { \
-        .backend_ops = (void *)0, \
-        .module_ops = &ldb_ ## name ## _module_ops \
-}
-
-static const struct ldb_builtins builtins[] = {
-        STATIC_LIBLDB_MODULES
-};
+        handle = dlopen(path, dlopen_flags);
+        if (handle == NULL) {
+                fprintf(stderr, "ldb: unable to dlopen %s : %s\n", path, dlerror());
+                return LDB_SUCCESS;
+        }
+
+        init_fn = dlsym(handle, "ldb_init_module");
+        if (init_fn == NULL) {
+                /* ignore it, it could be an old-style
+                 * module. Once we've converted all modules we
+                 * could consider this an error */
+                dlclose(handle);
+                return LDB_SUCCESS;
+        }
+
+        ret = init_fn(version);
+        if (ret == LDB_ERR_ENTRY_ALREADY_EXISTS) {
+                /* the module is already registered - ignore this, as
+                 * it can happen if LDB_MODULES_PATH points at both
+                 * the build and install directory
+                 */
+                ret = LDB_SUCCESS;
+        }
+        return ret;
+}
+
+static int qsort_string(const char **s1, const char **s2)
+{
+        return strcmp(*s1, *s2);
+}
+
+
+/*
+  load all modules from the given ldb modules directory. This is run once
+  during the first ldb_init() call.
+
+  Modules are loaded in alphabetical order to ensure that any module
+  load ordering dependencies are reproducible. Modules should avoid
+  relying on load order
+ */
+static int ldb_modules_load_dir(const char *modules_dir, const char *version)
+{
+        DIR *dir;
+        struct dirent *de;
+        const char **modlist = NULL;
+        TALLOC_CTX *tmp_ctx = talloc_new(NULL);
+        unsigned i, num_modules = 0;
+
+        dir = opendir(modules_dir);
+        if (dir == NULL) {
+                if (errno == ENOENT) {
+                        talloc_free(tmp_ctx);
+                        /* we don't have any modules */
+                        return LDB_SUCCESS;
+                }
+                talloc_free(tmp_ctx);
+                fprintf(stderr, "ldb: unable to open modules directory '%s' - %s\n",
+                        modules_dir, strerror(errno));
+                return LDB_ERR_UNAVAILABLE;
+        }
+
+
+        while ((de = readdir(dir))) {
+                if (ISDOT(de->d_name) || ISDOTDOT(de->d_name))
+                        continue;
+
+                modlist = talloc_realloc(tmp_ctx, modlist, const char *, num_modules+1);
+                if (modlist == NULL) {
+                        talloc_free(tmp_ctx);
+                        closedir(dir);
+                        fprintf(stderr, "ldb: unable to allocate modules list\n");
+                        return LDB_ERR_UNAVAILABLE;
+                }
+                modlist[num_modules] = talloc_asprintf(modlist, "%s/%s", modules_dir, de->d_name);
+                if (modlist[num_modules] == NULL) {
+                        talloc_free(tmp_ctx);
+                        closedir(dir);
+                        fprintf(stderr, "ldb: unable to allocate module list entry\n");
+                        return LDB_ERR_UNAVAILABLE;
+                }
+                num_modules++;
+        }
+
+        closedir(dir);
+
+        /* sort the directory, so we get consistent load ordering */
+        TYPESAFE_QSORT(modlist, num_modules, qsort_string);
+
+        for (i=0; i<num_modules; i++) {
+                int ret = ldb_modules_load_path(modlist[i], version);
+                if (ret != LDB_SUCCESS) {
+                        fprintf(stderr, "ldb: failed to initialise module %s : %s\n",
+                                modlist[i], ldb_strerror(ret));
+                        talloc_free(tmp_ctx);
+                        return ret;
+                }
+        }
+
+        talloc_free(tmp_ctx);
+
+        return LDB_SUCCESS;
+}
+
+/* 
+   load any additional modules from the given directory 
+*/
+void ldb_set_modules_dir(struct ldb_context *ldb, const char *path)
+{
+        int ret = ldb_modules_load_path(path, LDB_VERSION);
+        if (ret != LDB_SUCCESS) {
+                ldb_asprintf_errstring(ldb, "Failed to load modules from: %s\n", path);
+        }
+}
+
+
+/*
+  load all modules static (builtin) modules
+ */
+static int ldb_modules_load_static(const char *version)
+{
+        static bool initialised;
+#define _MODULE_PROTO(init) extern int init(const char *);
+        STATIC_ldb_MODULES_PROTO;
+        const ldb_module_init_fn static_init_functions[] = { STATIC_ldb_MODULES };
+        unsigned i;
+
+        if (initialised) {
+                return LDB_SUCCESS;
+        }
+        initialised = true;
+
+        for (i=0; static_init_functions[i]; i++) {
+                int ret = static_init_functions[i](version);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+        return LDB_SUCCESS;
+}
+
+/*
+  load all modules from the given ldb modules path, colon
+  separated.
+
+  modules are loaded recursively for all subdirectories in the paths
+ */
+int ldb_modules_load(const char *modules_path, const char *version)
+{
+        char *tok, *path, *tok_ptr=NULL;
+        int ret;
+
+        ret = ldb_modules_load_static(version);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        path = talloc_strdup(NULL, modules_path);
+        if (path == NULL) {
+                fprintf(stderr, "ldb: failed to allocate modules_path\n");
+                return LDB_ERR_UNAVAILABLE;
+        }
+
+        for (tok=strtok_r(path, ":", &tok_ptr);
+             tok;
+             tok=strtok_r(NULL, ":", &tok_ptr)) {
+                ret = ldb_modules_load_path(tok, version);
+                if (ret != LDB_SUCCESS) {
+                        talloc_free(path);
+                        return ret;
+                }
+        }
+        talloc_free(path);
+
+        return LDB_SUCCESS;
+}
+
+
+/*
+  return a string representation of the calling chain for the given
+  ldb request
+ */
+char *ldb_module_call_chain(struct ldb_request *req, TALLOC_CTX *mem_ctx)
+{
+        char *ret;
+        int i=0;
+
+        ret = talloc_strdup(mem_ctx, "");
+        if (ret == NULL) {
+                return NULL;
+        }
+
+        while (req && req->handle) {
+                char *s = talloc_asprintf_append_buffer(ret, "req[%u] %p  : %s\n",
+                                                        i++, req, ldb_req_location(req));
+                if (s == NULL) {
+                        talloc_free(ret);
+                        return NULL;
+                }
+                ret = s;
+                req = req->handle->parent;
+        }
+        return ret;
+}
+
+
+/*
+  return the next module in the chain
+ */
+struct ldb_module *ldb_module_next(struct ldb_module *module)
+{
+        return module->next;
+}
+
+/*
+  set the next module in the module chain
+ */
+void ldb_module_set_next(struct ldb_module *module, struct ldb_module *next)
+{
+        module->next = next;
+}
+
+
+/*
+  get the popt_options pointer in the ldb structure. This allows a ldb
+  module to change the command line parsing
+ */
+struct poptOption **ldb_module_popt_options(struct ldb_context *ldb)
+{
+        return &ldb->popt_options;
+}
+
+
+/*
+  return the current ldb flags LDB_FLG_*
+ */
+uint32_t ldb_module_flags(struct ldb_context *ldb)
+{
+        return ldb->flags;
+}

trunk/server/source4/lib/ldb/common/ldb_msg.c

@@ -37 +37 @@
   create a new ldb_message in a given memory context (NULL for top level)
 */
-struct ldb_message *ldb_msg_new(void *mem_ctx)
+struct ldb_message *ldb_msg_new(TALLOC_CTX *mem_ctx)
 {
         return talloc_zero(mem_ctx, struct ldb_message);
@@ -64 +64 @@
 {
         if (v1->length != v2->length) return 0;
-
+        if (v1->data == v2->data) return 1;
         if (v1->length == 0) return 1;
 
@@ -93 +93 @@
   duplicate a ldb_val structure
 */
-struct ldb_val ldb_val_dup(void *mem_ctx, const struct ldb_val *v)
+struct ldb_val ldb_val_dup(TALLOC_CTX *mem_ctx, const struct ldb_val *v)
 {
         struct ldb_val v2;
@@ -115 +115 @@
 }
 
-/*
-  add an empty element to a message
-*/
-int ldb_msg_add_empty(  struct ldb_message *msg,
-                        const char *attr_name,
-                        int flags,
-                        struct ldb_message_element **return_el)
+/**
+ * Adds new empty element to msg->elements
+ */
+static int _ldb_msg_add_el(struct ldb_message *msg,
+                           struct ldb_message_element **return_el)
 {
         struct ldb_message_element *els;
 
-        els = talloc_realloc(msg, msg->elements, 
-                             struct ldb_message_element, msg->num_elements+1);
+        /*
+         * TODO: Find out a way to assert on input parameters.
+         * msg and return_el must be valid
+         */
+
+        els = talloc_realloc(msg, msg->elements,
+                             struct ldb_message_element, msg->num_elements + 1);
         if (!els) {
                 errno = ENOMEM;
@@ -132 +135 @@
         }
 
-        els[msg->num_elements].values = NULL;
-        els[msg->num_elements].num_values = 0;
-        els[msg->num_elements].flags = flags;
-        els[msg->num_elements].name = talloc_strdup(els, attr_name);
-        if (!els[msg->num_elements].name) {
+        ZERO_STRUCT(els[msg->num_elements]);
+
+        msg->elements = els;
+        msg->num_elements++;
+
+        *return_el = &els[msg->num_elements-1];
+
+        return LDB_SUCCESS;
+}
+
+/**
+ * Add an empty element with a given name to a message
+ */
+int ldb_msg_add_empty(struct ldb_message *msg,
+                      const char *attr_name,
+                      int flags,
+                      struct ldb_message_element **return_el)
+{
+        int ret;
+        struct ldb_message_element *el;
+
+        ret = _ldb_msg_add_el(msg, &el);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        /* initialize newly added element */
+        el->flags = flags;
+        el->name = talloc_strdup(msg->elements, attr_name);
+        if (!el->name) {
                 errno = ENOMEM;
                 return LDB_ERR_OPERATIONS_ERROR;
         }
 
-        msg->elements = els;
-        msg->num_elements++;
-
         if (return_el) {
-                *return_el = &els[msg->num_elements-1];
+                *return_el = el;
         }
 
@@ -151 +176 @@
 }
 
-/*
-  add an empty element to a message
-*/
+/**
+ * Adds an element to a message.
+ *
+ * NOTE: Ownership of ldb_message_element fields
+ *       is NOT transferred. Thus, if *el pointer
+ *       is invalidated for some reason, this will
+ *       corrupt *msg contents also
+ */
 int ldb_msg_add(struct ldb_message *msg, 
                 const struct ldb_message_element *el, 
                 int flags)
 {
+        int ret;
+        struct ldb_message_element *el_new;
         /* We have to copy this, just in case *el is a pointer into
          * what ldb_msg_add_empty() is about to realloc() */
         struct ldb_message_element el_copy = *el;
-        if (ldb_msg_add_empty(msg, el->name, flags, NULL) != 0) {
-                return LDB_ERR_OPERATIONS_ERROR;
-        }
-
-        msg->elements[msg->num_elements-1] = el_copy;
-        msg->elements[msg->num_elements-1].flags = flags;
+
+        ret = _ldb_msg_add_el(msg, &el_new);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        el_new->flags      = flags;
+        el_new->name       = el_copy.name;
+        el_new->num_values = el_copy.num_values;
+        el_new->values     = el_copy.values;
 
         return LDB_SUCCESS;
@@ -191 +227 @@
         }
 
-        vals = talloc_realloc(msg, el->values, struct ldb_val, el->num_values+1);
+        vals = talloc_realloc(msg->elements, el->values, struct ldb_val,
+                              el->num_values+1);
         if (!vals) {
                 errno = ENOMEM;
@@ -238 +275 @@
 
         if (val.length == 0) {
-                /* allow empty strings as non-existant attributes */
+                /* allow empty strings as non-existent attributes */
                 return LDB_SUCCESS;
         }
@@ -256 +293 @@
         val.length = strlen(str);
 
+        if (val.length == 0) {
+                /* allow empty strings as non-existent attributes */
+                return LDB_SUCCESS;
+        }
+
         return ldb_msg_add_steal_value(msg, attr_name, &val);
+}
+
+/*
+  add a DN element to a message
+  WARNING: this uses the linearized string from the dn, and does not
+  copy the string.
+*/
+int ldb_msg_add_linearized_dn(struct ldb_message *msg, const char *attr_name,
+                              struct ldb_dn *dn)
+{
+        char *str = ldb_dn_alloc_linearized(msg, dn);
+
+        if (str == NULL) {
+                /* we don't want to have unknown DNs added */
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
+        return ldb_msg_add_steal_string(msg, attr_name, str);
 }
 
@@ -283 +343 @@
 /*
   compare two ldb_message_element structures
-  assumes case senistive comparison
+  assumes case sensitive comparison
 */
 int ldb_msg_element_compare(struct ldb_message_element *el1, 
@@ -342 +402 @@
                                        unsigned int default_value)
 {
+        unsigned int ret;
         const struct ldb_val *v = ldb_msg_find_ldb_val(msg, attr_name);
         if (!v || !v->data) {
                 return default_value;
         }
+
+        /* in LDAP there're only int32_t values */
+        errno = 0;
+        ret = strtol((const char *)v->data, NULL, 0);
+        if (errno == 0) {
+                return ret;
+        }
+
         return strtoul((const char *)v->data, NULL, 0);
 }
@@ -364 +433 @@
                                      uint64_t default_value)
 {
+        uint64_t ret;
         const struct ldb_val *v = ldb_msg_find_ldb_val(msg, attr_name);
         if (!v || !v->data) {
                 return default_value;
         }
+
+        /* in LDAP there're only int64_t values */
+        errno = 0;
+        ret = strtoll((const char *)v->data, NULL, 0);
+        if (errno == 0) {
+                return ret;
+        }
+
         return strtoull((const char *)v->data, NULL, 0);
 }
@@ -411 +489 @@
 
 struct ldb_dn *ldb_msg_find_attr_as_dn(struct ldb_context *ldb,
-                                       void *mem_ctx,
+                                       TALLOC_CTX *mem_ctx,
                                        const struct ldb_message *msg,
                                        const char *attr_name)
@@ -435 +513 @@
 void ldb_msg_sort_elements(struct ldb_message *msg)
 {
-        qsort(msg->elements, msg->num_elements, sizeof(struct ldb_message_element), 
-              (comparison_fn_t)ldb_msg_element_compare_name);
+        TYPESAFE_QSORT(msg->elements, msg->num_elements,
+                       ldb_msg_element_compare_name);
 }
 
@@ -447 +525 @@
 {
         struct ldb_message *msg2;
-        int i;
+        unsigned int i;
 
         msg2 = talloc(mem_ctx, struct ldb_message);
@@ -477 +555 @@
 {
         struct ldb_message *msg2;
-        int i, j;
+        unsigned int i, j;
 
         msg2 = ldb_msg_copy_shallow(mem_ctx, msg);
@@ -507 +585 @@
 
 
-/*
-  canonicalise a message, merging elements of the same name
-*/
+/**
+ * Canonicalize a message, merging elements of the same name
+ */
 struct ldb_message *ldb_msg_canonicalize(struct ldb_context *ldb, 
                                          const struct ldb_message *msg)
 {
-        int i;
+        int ret;
         struct ldb_message *msg2;
 
-        msg2 = ldb_msg_copy(ldb, msg);
-        if (msg2 == NULL) return NULL;
+        /*
+         * Preserve previous behavior and allocate
+         * *msg2 into *ldb context
+         */
+        ret = ldb_msg_normalize(ldb, ldb, msg, &msg2);
+        if (ret != LDB_SUCCESS) {
+                return NULL;
+        }
+
+        return msg2;
+}
+
+/**
+ * Canonicalize a message, merging elements of the same name
+ */
+int ldb_msg_normalize(struct ldb_context *ldb,
+                      TALLOC_CTX *mem_ctx,
+                      const struct ldb_message *msg,
+                      struct ldb_message **_msg_out)
+{
+        unsigned int i;
+        struct ldb_message *msg2;
+
+        msg2 = ldb_msg_copy(mem_ctx, msg);
+        if (msg2 == NULL) {
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
 
         ldb_msg_sort_elements(msg2);
 
-        for (i=1;i<msg2->num_elements;i++) {
+        for (i=1; i < msg2->num_elements; i++) {
                 struct ldb_message_element *el1 = &msg2->elements[i-1];
                 struct ldb_message_element *el2 = &msg2->elements[i];
+
                 if (ldb_msg_element_compare_name(el1, el2) == 0) {
-                        el1->values = talloc_realloc(msg2->elements, el1->values, struct ldb_val, 
-                                                       el1->num_values + el2->num_values);
-                        if (el1->values == NULL) {
-                                return NULL;
+                        el1->values = talloc_realloc(msg2->elements,
+                                                     el1->values, struct ldb_val,
+                                                     el1->num_values + el2->num_values);
+                        if (el1->num_values + el2->num_values > 0 && el1->values == NULL) {
+                                talloc_free(msg2);
+                                return LDB_ERR_OPERATIONS_ERROR;
                         }
                         memcpy(el1->values + el1->num_values,
@@ -535 +641 @@
                         el1->num_values += el2->num_values;
                         talloc_free(discard_const_p(char, el2->name));
-                        if (i+1<msg2->num_elements) {
-                                memmove(el2, el2+1, sizeof(struct ldb_message_element) * 
+                        if ((i+1) < msg2->num_elements) {
+                                memmove(el2, el2+1, sizeof(struct ldb_message_element) *
                                         (msg2->num_elements - (i+1)));
                         }
@@ -544 +650 @@
         }
 
-        return msg2;
-}
-
-
-/*
-  return a ldb_message representing the differences between msg1 and msg2. If you
-  then use this in a ldb_modify() call it can be used to save edits to a message
-*/
+        *_msg_out = msg2;
+        return LDB_SUCCESS;
+}
+
+
+/**
+ * return a ldb_message representing the differences between msg1 and msg2.
+ * If you then use this in a ldb_modify() call,
+ * it can be used to save edits to a message
+ */
 struct ldb_message *ldb_msg_diff(struct ldb_context *ldb, 
                                  struct ldb_message *msg1,
                                  struct ldb_message *msg2)
 {
+        int ldb_ret;
+        struct ldb_message *mod;
+
+        ldb_ret = ldb_msg_difference(ldb, ldb, msg1, msg2, &mod);
+        if (ldb_ret != LDB_SUCCESS) {
+                return NULL;
+        }
+
+        return mod;
+}
+
+/**
+ * return a ldb_message representing the differences between msg1 and msg2.
+ * If you then use this in a ldb_modify() call it can be used to save edits to a message
+ *
+ * Result message is constructed as follows:
+ * - LDB_FLAG_MOD_ADD     - elements found only in msg2
+ * - LDB_FLAG_MOD_REPLACE - elements in msg2 that have different value in msg1
+ *                          Value for msg2 element is used
+ * - LDB_FLAG_MOD_DELETE  - elements found only in msg2
+ *
+ * @return LDB_SUCCESS or LDB_ERR_OPERATIONS_ERROR
+ */
+int ldb_msg_difference(struct ldb_context *ldb,
+                       TALLOC_CTX *mem_ctx,
+                       struct ldb_message *msg1,
+                       struct ldb_message *msg2,
+                       struct ldb_message **_msg_out)
+{
+        int ldb_res;
+        unsigned int i;
         struct ldb_message *mod;
         struct ldb_message_element *el;
-        unsigned int i;
-
-        mod = ldb_msg_new(ldb);
+        TALLOC_CTX *temp_ctx;
+
+        temp_ctx = talloc_new(mem_ctx);
+        if (!temp_ctx) {
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+
+        mod = ldb_msg_new(temp_ctx);
+        if (mod == NULL) {
+                goto failed;
+        }
 
         mod->dn = msg1->dn;
@@ -566 +713 @@
         mod->elements = NULL;
 
-        msg2 = ldb_msg_canonicalize(ldb, msg2);
-        if (msg2 == NULL) {
-                return NULL;
-        }
-        
-        /* look in msg2 to find elements that need to be added
-           or modified */
+        /*
+         * Canonicalize *msg2 so we have no repeated elements
+         * Resulting message is allocated in *mod's mem context,
+         * as we are going to move some elements from *msg2 to
+         * *mod object later
+         */
+        ldb_res = ldb_msg_normalize(ldb, mod, msg2, &msg2);
+        if (ldb_res != LDB_SUCCESS) {
+                goto failed;
+        }
+
+        /* look in msg2 to find elements that need to be added or modified */
         for (i=0;i<msg2->num_elements;i++) {
                 el = ldb_msg_find_element(msg1, msg2->elements[i].name);
@@ -580 +732 @@
                 }
 
-                if (ldb_msg_add(mod, 
-                                &msg2->elements[i],
-                                el?LDB_FLAG_MOD_REPLACE:LDB_FLAG_MOD_ADD) != 0) {
-                        return NULL;
+                ldb_res = ldb_msg_add(mod,
+                                      &msg2->elements[i],
+                                      el ? LDB_FLAG_MOD_REPLACE : LDB_FLAG_MOD_ADD);
+                if (ldb_res != LDB_SUCCESS) {
+                        goto failed;
                 }
         }
@@ -590 +743 @@
         for (i=0;i<msg1->num_elements;i++) {
                 el = ldb_msg_find_element(msg2, msg1->elements[i].name);
-                if (!el) {
-                        if (ldb_msg_add_empty(mod, 
-                                              msg1->elements[i].name,
-                                              LDB_FLAG_MOD_DELETE, NULL) != 0) {
-                                return NULL;
+                if (el == NULL) {
+                        ldb_res = ldb_msg_add_empty(mod,
+                                                    msg1->elements[i].name,
+                                                    LDB_FLAG_MOD_DELETE, NULL);
+                        if (ldb_res != LDB_SUCCESS) {
+                                goto failed;
                         }
                 }
         }
 
-        return mod;
-}
+        /* steal resulting message into supplied context */
+        talloc_steal(mem_ctx, mod);
+        *_msg_out = mod;
+
+        talloc_free(temp_ctx);
+        return LDB_SUCCESS;
+
+failed:
+        talloc_free(temp_ctx);
+        return LDB_ERR_OPERATIONS_ERROR;
+}
+
 
 int ldb_msg_sanity_check(struct ldb_context *ldb, 
                          const struct ldb_message *msg)
 {
-        int i, j;
+        unsigned int i, j;
 
         /* basic check on DN */
@@ -643 +807 @@
 {
         const char **ret;
-        int i;
+        unsigned int i;
+
         for (i=0;attrs && attrs[i];i++) /* noop */ ;
         ret = talloc_array(mem_ctx, const char *, i+1);
@@ -664 +829 @@
 {
         const char **ret;
-        int i;
+        unsigned int i;
         bool found = false;
+
         for (i=0;attrs && attrs[i];i++) {
                 if (ldb_attr_cmp(attrs[i], new_attr) == 0) {
@@ -692 +858 @@
 int ldb_attr_in_list(const char * const *attrs, const char *attr)
 {
-        int i;
+        unsigned int i;
         for (i=0;attrs && attrs[i];i++) {
                 if (ldb_attr_cmp(attrs[i], attr) == 0) {
@@ -725 +891 @@
 {
         struct ldb_message_element *el = ldb_msg_find_element(msg, attr);
+        int ret;
+
         if (el == NULL) {
                 return LDB_SUCCESS;
         }
-        if (ldb_msg_add(msg, el, 0) != 0) {
-                return LDB_ERR_OPERATIONS_ERROR;
+        ret = ldb_msg_add(msg, el, 0);
+        if (ret != LDB_SUCCESS) {
+                return ret;
         }
         return ldb_msg_rename_attr(msg, attr, replace);
@@ -739 +908 @@
 void ldb_msg_remove_element(struct ldb_message *msg, struct ldb_message_element *el)
 {
-        int n = (el - msg->elements);
+        ptrdiff_t n = (el - msg->elements);
         if (n >= msg->num_elements) {
                 /* should we abort() here? */
@@ -756 +925 @@
 void ldb_msg_remove_attr(struct ldb_message *msg, const char *attr)
 {
-        struct ldb_message_element *el = ldb_msg_find_element(msg, attr);
-        if (el) {
+        struct ldb_message_element *el;
+
+        while ((el = ldb_msg_find_element(msg, attr)) != NULL) {
                 ldb_msg_remove_element(msg, el);
         }
@@ -803 +973 @@
         
         memset(&tm, 0, sizeof(tm));
-        if (sscanf(s, "%04u%02u%02u%02u%02u%02u", 
+        if (sscanf(s, "%04u%02u%02u%02u%02u%02u.0Z",
                    &tm.tm_year, &tm.tm_mon, &tm.tm_mday, 
                    &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
@@ -812 +982 @@
         
         return timegm(&tm);
+}
+
+/*
+  convert a LDAP GeneralizedTime string in ldb_val format to a
+  time_t.
+*/
+int ldb_val_to_time(const struct ldb_val *v, time_t *t)
+{
+        struct tm tm;
+
+        if (v == NULL || !v->data || v->length < 17) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+
+        memset(&tm, 0, sizeof(tm));
+
+        if (sscanf((char *)v->data, "%04u%02u%02u%02u%02u%02u.0Z",
+                   &tm.tm_year, &tm.tm_mon, &tm.tm_mday,
+                   &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        tm.tm_year -= 1900;
+        tm.tm_mon -= 1;
+
+        *t = timegm(&tm);
+
+        return LDB_SUCCESS;
 }
 
@@ -855 +1052 @@
         
         memset(&tm, 0, sizeof(tm));
-        if (sscanf(s, "%02u%02u%02u%02u%02u%02u", 
+        if (sscanf(s, "%02u%02u%02u%02u%02u%02uZ",
                    &tm.tm_year, &tm.tm_mon, &tm.tm_mday, 
                    &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) {
@@ -874 +1071 @@
 void ldb_dump_results(struct ldb_context *ldb, struct ldb_result *result, FILE *f)
 {
-        int i;
+        unsigned int i;
 
         for (i = 0; i < result->count; i++) {
@@ -885 +1082 @@
 }
 
-int ldb_msg_check_string_attribute(const struct ldb_message *msg, const char *name, const char *value)
+/*
+  checks for a string attribute. Returns "1" on match and otherwise "0".
+*/
+int ldb_msg_check_string_attribute(const struct ldb_message *msg,
+                                   const char *name, const char *value)
 {
         struct ldb_message_element *el;
@@ -891 +1092 @@
         
         el = ldb_msg_find_element(msg, name);
-        if (el == NULL)
+        if (el == NULL) {
                 return 0;
+        }
 
         val.data = discard_const_p(uint8_t, value);
         val.length = strlen(value);
 
-        if (ldb_msg_find_val(el, &val))
+        if (ldb_msg_find_val(el, &val)) {
                 return 1;
+        }
 
         return 0;
 }
+

trunk/server/source4/lib/ldb/common/ldb_parse.c

@@ -43 +43 @@
 #include "ldb_private.h"
 #include "system/locale.h"
+
+static int ldb_parse_hex2char(const char *x)
+{
+        if (isxdigit(x[0]) && isxdigit(x[1])) {
+                const char h1 = x[0], h2 = x[1];
+                int c = 0;
+
+                if (h1 >= 'a') c = h1 - (int)'a' + 10;
+                else if (h1 >= 'A') c = h1 - (int)'A' + 10;
+                else if (h1 >= '0') c = h1 - (int)'0';
+                c = c << 4;
+                if (h2 >= 'a') c += h2 - (int)'a' + 10;
+                else if (h2 >= 'A') c += h2 - (int)'A' + 10;
+                else if (h2 >= '0') c += h2 - (int)'0';
+
+                return c;
+        }
+
+        return -1;
+}
 
 /*
@@ -60 +80 @@
    Used in LDAP filters.
 */
-struct ldb_val ldb_binary_decode(void *mem_ctx, const char *str)
-{
-        int i, j;
+struct ldb_val ldb_binary_decode(TALLOC_CTX *mem_ctx, const char *str)
+{
+        size_t i, j;
         struct ldb_val ret;
-        int slen = str?strlen(str):0;
+        size_t slen = str?strlen(str):0;
 
         ret.data = (uint8_t *)talloc_size(mem_ctx, slen+1);
@@ -72 +92 @@
         for (i=j=0;i<slen;i++) {
                 if (str[i] == '\\') {
-                        unsigned c;
-                        if (sscanf(&str[i+1], "%02X", &c) != 1) {
+                        int c;
+
+                        c = ldb_parse_hex2char(&str[i+1]);
+                        if (c == -1) {
                                 talloc_free(ret.data);
                                 memset(&ret, 0, sizeof(ret));
@@ -95 +117 @@
    non-printable or '\' characters
 */
-char *ldb_binary_encode(void *mem_ctx, struct ldb_val val)
-{
-        int i;
+char *ldb_binary_encode(TALLOC_CTX *mem_ctx, struct ldb_val val)
+{
+        size_t i;
         char *ret;
-        int len = val.length;
+        size_t len = val.length;
         unsigned char *buf = val.data;
 
@@ -130 +152 @@
    in escaping user data in ldap filters.
 */
-char *ldb_binary_encode_string(void *mem_ctx, const char *string)
+char *ldb_binary_encode_string(TALLOC_CTX *mem_ctx, const char *string)
 {
         struct ldb_val val;
+        if (string == NULL) {
+                return NULL;
+        }
         val.data = discard_const_p(uint8_t, string);
         val.length = strlen(string);
@@ -160 +185 @@
    chunks separated by wildcards that makes the value portion of the filter
 */
-static struct ldb_val **ldb_wildcard_decode(void *mem_ctx, const char *string)
+static struct ldb_val **ldb_wildcard_decode(TALLOC_CTX *mem_ctx, const char *string)
 {
         struct ldb_val **ret = NULL;
-        int val = 0;
+        unsigned int val = 0;
         char *wc, *str;
 
@@ -200 +225 @@
 }
 
-static struct ldb_parse_tree *ldb_parse_filter(void *mem_ctx, const char **s);
+static struct ldb_parse_tree *ldb_parse_filter(TALLOC_CTX *mem_ctx, const char **s);
 
 
@@ -254 +279 @@
 }
 
-static enum ldb_parse_op ldb_parse_filtertype(void *mem_ctx, char **type, char **value, const char **s)
+static enum ldb_parse_op ldb_parse_filtertype(TALLOC_CTX *mem_ctx, char **type, char **value, const char **s)
 {
         enum ldb_parse_op filter = 0;
@@ -352 +377 @@
   <simple> ::= <attributetype> <filtertype> <attributevalue>
 */
-static struct ldb_parse_tree *ldb_parse_simple(void *mem_ctx, const char **s)
+static struct ldb_parse_tree *ldb_parse_simple(TALLOC_CTX *mem_ctx, const char **s)
 {
         char *attr, *value;
@@ -467 +492 @@
   <filterlist> ::= <filter> | <filter> <filterlist>
 */
-static struct ldb_parse_tree *ldb_parse_filterlist(void *mem_ctx, const char **s)
+static struct ldb_parse_tree *ldb_parse_filterlist(TALLOC_CTX *mem_ctx, const char **s)
 {
         struct ldb_parse_tree *ret, *next;
@@ -535 +560 @@
   <not> ::= '!' <filter>
 */
-static struct ldb_parse_tree *ldb_parse_not(void *mem_ctx, const char **s)
+static struct ldb_parse_tree *ldb_parse_not(TALLOC_CTX *mem_ctx, const char **s)
 {
         struct ldb_parse_tree *ret;
@@ -567 +592 @@
   <filtercomp> ::= <and> | <or> | <not> | <simple>
 */
-static struct ldb_parse_tree *ldb_parse_filtercomp(void *mem_ctx, const char **s)
+static struct ldb_parse_tree *ldb_parse_filtercomp(TALLOC_CTX *mem_ctx, const char **s)
 {
         struct ldb_parse_tree *ret;
@@ -604 +629 @@
   <filter> ::= '(' <filtercomp> ')'
 */
-static struct ldb_parse_tree *ldb_parse_filter(void *mem_ctx, const char **s)
+static struct ldb_parse_tree *ldb_parse_filter(TALLOC_CTX *mem_ctx, const char **s)
 {
         struct ldb_parse_tree *ret;
@@ -636 +661 @@
   expression ::= <simple> | <filter>
 */
-struct ldb_parse_tree *ldb_parse_tree(void *mem_ctx, const char *s)
+struct ldb_parse_tree *ldb_parse_tree(TALLOC_CTX *mem_ctx, const char *s)
 {
         if (s == NULL || *s == 0) {
@@ -655 +680 @@
   construct a ldap parse filter given a parse tree
 */
-char *ldb_filter_from_tree(void *mem_ctx, struct ldb_parse_tree *tree)
+char *ldb_filter_from_tree(TALLOC_CTX *mem_ctx, const struct ldb_parse_tree *tree)
 {
         char *s, *s2, *ret;
-        int i;
+        unsigned int i;
 
         if (tree == NULL) {
@@ -774 +799 @@
 
 /*
-  replace any occurances of an attribute name in the parse tree with a
+  replace any occurrences of an attribute name in the parse tree with a
   new name
 */
@@ -781 +806 @@
                                  const char *replace)
 {
-        int i;
+        unsigned int i;
         switch (tree->operation) {
         case LDB_OP_AND:
@@ -827 +852 @@
                                                    const struct ldb_parse_tree *ot)
 {
-        int i;
+        unsigned int i;
         struct ldb_parse_tree *nt;
 

trunk/server/source4/lib/ldb/common/ldb_utf8.c

@@ -54 +54 @@
   NOTE: does not handle UTF8
 */
-char *ldb_casefold_default(void *context, void *mem_ctx, const char *s, size_t n)
+char *ldb_casefold_default(void *context, TALLOC_CTX *mem_ctx, const char *s, size_t n)
 {
-        int i;
+        size_t i;
         char *ret = talloc_strndup(mem_ctx, s, n);
         if (!s) {
@@ -73 +73 @@
 }
 
-char *ldb_casefold(struct ldb_context *ldb, void *mem_ctx, const char *s, size_t n)
+char *ldb_casefold(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *s, size_t n)
 {
         return ldb->utf8_fns.casefold(ldb->utf8_fns.context, mem_ctx, s, n);
@@ -85 +85 @@
 int ldb_valid_attr_name(const char *s)
 {
-        int i;
+        size_t i;
 
         if (!s || !s[0])
@@ -110 +110 @@
 }
 
-char *ldb_attr_casefold(void *mem_ctx, const char *s)
+char *ldb_attr_casefold(TALLOC_CTX *mem_ctx, const char *s)
 {
-        int i;
+        size_t i;
         char *ret = talloc_strdup(mem_ctx, s);
         if (!ret) {