Resolves: bug 450575

Bug Description: unbind or abandon with unsupported critical controls does not close connection
Reviewed by: nkinder (Thanks!)
Fix Description: When an unbind request is received that has controls marked as critical, and we do not support those controls, we must treat them as non-critical controls and continue processing.
Platforms tested: RHEL4, RHEL5
Flag Day: no
Doc impact: no

ldap/servers/slapd/control.c

@@ -183,12 +183,16 @@ int slapi_get_supported_controls_copy( char ***ctrloidsp, unsigned long **ctrlop
 	return (0);
 }
 
-
+/*
+ * RFC 4511 section 4.1.11.  Controls says that the UnbindRequest
+ * MUST ignore the criticality field of controls
+ */
 int
-get_ldapmessage_controls(
+get_ldapmessage_controls_ext(
     Slapi_PBlock	*pb,
     BerElement		*ber,
-    LDAPControl		***controlsp	/* can be NULL if no need to return */
+    LDAPControl		***controlsp,	/* can be NULL if no need to return */
+    int                 ignore_criticality /* some requests must ignore criticality */
 )
 {
 	LDAPControl		**ctrls, *new;
@@ -294,6 +298,10 @@ get_ldapmessage_controls(
 			/* absent is synonomous with FALSE */
 			new->ldctl_iscritical = 0;
 		}
+		/* if we are ignoring criticality, treat as FALSE */
+		if (ignore_criticality) {
+		    new->ldctl_iscritical = 0;
+		}
 
 		/*
 		 * return an appropriate error if this control is marked
@@ -380,6 +388,15 @@ free_and_return:;
 	return( rc );
 }
 
+int
+get_ldapmessage_controls(
+    Slapi_PBlock	*pb,
+    BerElement		*ber,
+    LDAPControl		***controlsp	/* can be NULL if no need to return */
+)
+{
+    return get_ldapmessage_controls_ext(pb, ber, controlsp, 0 /* do not ignore criticality */);
+}
 
 int
 slapi_control_present( LDAPControl **controls, char *oid, struct berval **val, int *iscritical )

ldap/servers/slapd/proto-slap.h

@@ -494,6 +494,8 @@ int load_plugin_entry(Slapi_PBlock *pb, Slapi_Entry* e, Slapi_Entry* entryAfter,
 void init_controls( void );
 int get_ldapmessage_controls( Slapi_PBlock *pb, BerElement *ber,
 	LDAPControl ***controls );
+int get_ldapmessage_controls_ext( Slapi_PBlock *pb, BerElement *ber,
+	LDAPControl ***controls, int ignore_criticality );
 int write_controls( BerElement *ber, LDAPControl **ctrls );
 void add_control( LDAPControl ***ctrlsp, LDAPControl *newctrl );
 

ldap/servers/slapd/unbind.c

@@ -68,6 +68,7 @@ do_unbind( Slapi_PBlock *pb )
 	Slapi_Operation *operation;
 	BerElement	*ber;
 	int		err;
+	int ignore_criticality = 1;
 
 	LDAPDebug( LDAP_DEBUG_TRACE, "do_unbind\n", 0, 0, 0 );
 
@@ -90,8 +91,10 @@ do_unbind( Slapi_PBlock *pb )
 	 * in LDAPv3 there can be optional control extensions on
 	 * the end of an LDAPMessage. we need to read them in and
 	 * pass them to the backend.
+	 * RFC 4511 section 4.1.11.  Controls says that the UnbindRequest
+	 * MUST ignore the criticality field of controls
 	 */
-	if ( (err = get_ldapmessage_controls( pb, ber, NULL )) != 0 ) {
+	if ( (err = get_ldapmessage_controls_ext( pb, ber, NULL, ignore_criticality )) != 0 ) {
 		slapi_log_access( LDAP_DEBUG_STATS, "conn=%" NSPRIu64 " op=%d UNBIND,"
 				" error processing controls - error %d (%s)\n",
 				pb->pb_conn->c_connid, operation->o_opid,