Hi all!
To avoid the slapd’s core dump when using component match filters (see ITS # 6556) I removed line 556 of file “servers/slapd/filter.c”:

         case LDAP_FILTER_EXT:

                //mra_free( op, f->f_mra, 1 );

                break;

Now component match filter search requests are answered by slapd but don’t work correctly. In fact nothing is found! For example the request

/home/openldap/openldap-2.4.21-install/bin/ldapsearch -h localhost -p 9389 -D cn=openldapadmin -w welcome -b o=CustomerCA,c=de -s sub "(userCertificate:componentFilterMatch:=item:{ component \"toBeSigned.serialNumber\", rule allComponentsMatch, value 449 })" sncertnr

Is answered with

# extended LDIF

#

# LDAPv3

# base <o=CustomerCA,c=de> with scope subtree

# filter: (userCertificate:componentFilterMatch:=item:{ component "toBeSigned.serialNumber", rule allComponentsMatch, value 449 })

# requesting: sncertnr

#

# search result

search: 2

result: 0 Success

# numResponses: 1

But in the database of slapd there are several certificates with serialNumber 449:

lehnert.hartmut@sn-ocspr4:/opt/lehnert/Openldap-Support$ ./dumpasn1  449.cer

   0 30  702: SEQUENCE {

   4 30  551:   SEQUENCE {

   8 A0    3:     [0] {

  10 02    1:       INTEGER 2

            :       }

  13 02    2:     INTEGER 449

  17 30   13:     SEQUENCE {

  19 06    9:       OBJECT IDENTIFIER

            :         sha256WithRSAEncryption (1 2 840 113549 1 1 11)

  30 05    0:       NULL

            :       }

  32 30  111:     SEQUENCE {

  34 31   11:       SET {

  36 30    9:         SEQUENCE {

  38 06    3:           OBJECT IDENTIFIER countryName (2 5 4 6)

  43 13    2:           PrintableString 'DE'

            :           }

            :         }

  47 31   12:       SET {

On slapd’s side the debug message

bdb_search: <integer> does not match filter

is written out for every record.

What’s going wrong here?

Regards,

Hartmut