From 7a59bff0f83aa3201951f10cc0e08e56b06c81eb Mon Sep 17 00:00:00 2001
From: Thierry Bordaz <tbordaz@redhat.com>
Date: Dec 17 2019 10:20:17 +0000
Subject: Ticket 50727: (cont) change default + additional log


---

diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 549617d..e32427c 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -166,7 +166,7 @@ typedef enum {
     CONFIG_SPECIAL_VALIDATE_CERT_SWITCH, /* maps strings to an enumeration */
     CONFIG_SPECIAL_UNHASHED_PW_SWITCH,   /* unhashed pw: on/off/nolog */
     CONFIG_SPECIAL_TLS_CHECK_CRL,        /* maps enum tls_check_crl_t to char * */
-    CONFIG_SPECIAL_FILTER_VERIFY,      /* maps to a config strict/warn-strict/warn/off enum */
+    CONFIG_SPECIAL_FILTER_VERIFY,        /* maps to a config strict/warn-strict/warn/off enum */
 } ConfigVarType;
 
 static int32_t config_set_onoff(const char *attrname, char *value, int32_t *configvalue, char *errorbuf, int apply);
@@ -1783,7 +1783,7 @@ FrontendConfig_init(void)
      * scheme set in cn=config
      */
     init_enable_upgrade_hash = cfg->enable_upgrade_hash = LDAP_ON;
-    init_verify_filter_schema = cfg->verify_filter_schema = SLAPI_WARN_SAFE;
+    init_verify_filter_schema = cfg->verify_filter_schema = SLAPI_WARN_UNSAFE;
 
     /* Done, unlock!  */
     CFG_UNLOCK_WRITE(cfg);
@@ -7692,7 +7692,7 @@ config_set_specialfilterverify(slapdFrontendConfig_t *slapdFrontendConfig, slapi
         return LDAP_OPERATIONS_ERROR;
     }
 
-    slapi_special_filter_verify_t p_val = SLAPI_WARN_SAFE;
+    slapi_special_filter_verify_t p_val = SLAPI_WARN_UNSAFE;
 
     /* on/warn/off retained for legacy reasons due to wbrown making terrible mistakes :( :( */
     if (strcasecmp(value, "on") == 0) {
diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index 6cdb276..efaf164 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -35,7 +35,7 @@ static void log_search_access(Slapi_PBlock *pb, const char *base, int scope, con
 void
 do_search(Slapi_PBlock *pb)
 {
-    Slapi_Operation *operation;
+    Slapi_Operation *operation = NULL;
     BerElement *ber;
     int i, err = 0, attrsonly;
     ber_int_t scope, deref, sizelimit, timelimit;
@@ -220,6 +220,34 @@ do_search(Slapi_PBlock *pb)
         send_ldap_result(pb, err, NULL, errtxt, 0, NULL);
         goto free_and_return;
     }
+    if (r == FILTER_SCHEMA_WARNING) {
+        /* A notes=F will be logged in access log
+         * Anyway make it noisy with a log in error log
+         * as the behavior will change in upcoming release =>
+         * it needs to be fixed
+         */
+        if (config_get_verify_filter_schema() == FILTER_POLICY_WARNING) {
+            /* A component with unknown attribute was possibly processed
+             * with an unindexed scan
+             */
+            slapi_log_err(SLAPI_LOG_WARNING, "do_search",
+                    "Search filter \"%s\" contains unknown attribute. Possible performance impact (conn=%d op=%d).\n",
+                    fstr ? fstr : "NULL",
+                    operation ? operation->o_connid : "unknown",
+                    operation ? operation->o_opid : "unknown");
+        } else if (config_get_verify_filter_schema() == FILTER_POLICY_PROTECT) {
+            /* A component with unknown attribute was translated in
+             * a idl=0 (no entry matching). It protects the server against
+             * unindexed scan but the return result may ignore some
+             * matching entries
+             */
+            slapi_log_err(SLAPI_LOG_WARNING, "do_search",
+                    "Search filter \"%s\" contains unknown attribute. Possible invalid result set (conn=%d op=%d).\n",
+                    fstr ? fstr : "NULL",
+                    operation ? operation->o_connid : "unknown",
+                    operation ? operation->o_opid : "unknown");
+        }
+    }
 
     /* attributes */
     attrs = NULL;