GitLab

Fix nameAndOptionalIdentifer syntax.

now dnValidate loops thru each value; added private member to LDAPAVA to hold the attribute description

liberally accept many LDAPv2/LDAPv3 stuff in DN (quoted parts, ';' as rdn separator and so); enforce exact case match of normalized dn in dnMatch (let's see what happens ...); fix a ldapava_free_rdn bug

Add flag to matching rules to indicate if DN folding is needed.
Don't specify dnPretty as pretty function for DN attribute types as
this works too well (it breaks tests).

A pretty routine may rewrite the representation of a value but
must not alter the value itself.

another step towards schema aware normalization: ava sorting in rdns; now by defining USE_LDAP_DN_PARSING both the new dn parsing and the server side normalization is used. There might be, every now and then, a flaw mostly due to naive normalization of pseudo-dn (thinking about some acl/regex stuff and so)

reimplement dn_validate/normalize/(match) using the ldap_str2dn/dn2str stuff; need to #define USE_LDAP_DN_PARSING

you can search efficiently the directory for a certificate.

Notice that we index certificates just as serial integers.  A full
index should combine the issuer DN too, but I think in most scenarios
that would be extremely redundant and of little benefit.  We can add
an option later to do full indexing.

error reporting to client and syslog. And indexing, of course.

Now, the problem is that matching rules get called from different
places that are inconsistent in what an assertedValue is.  When doing
a modify, a full certificate value is passed (to verify it isn't
already there).  When doing a search or compare, the passed value is
in the syntax of the matching rule.

Consistency would require that the caller extracts an asserted value
from the full value before calling smr_match.  It can do this by
calling smr_convert (it was unused, was it meant to be used for
this?).

Unfortunately, the caller is typically value_find, value_match, etc.
that have themselves little knowledge of what they are dealing with,
so their interface needs to be extended, new flag values or new
arguments, so that they know if they have a value in attribute type
syntax or in matching rule syntax.

indexing.

and integerBitOrMatch enhancement (ITS#1302 + minor changes)
from Luke Howard <lukeh@padl.com>.

case-Exact/Ignore-Substrings-Match/Filter/Indexer with common code for
the caseExact and caseIgnore cases

but can really be removed.