Add error handling to hotpaths that may panic

.github/workflows/build.yml

@@ -7,59 +7,160 @@ on:
   pull_request:
     branches:
       - master
+      - dev
+
+permissions:
+  contents: read
 
 jobs:
   build:
 
-    runs-on: ${{ matrix.os }}
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:large
+
+    container: public.ecr.aws/docker/library/rust:1
 
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-2022, macOS-latest]
         rust: [stable, nightly]
         features: ["default", "sync,tls-rustls-ring"]
 
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTC_WRAPPER: sccache
+      SCCACHE_BUCKET: defguard-gh-build-cache
+      SCCACHE_REGION: eu-central-1
+      AWS_ACCESS_KEY_ID: ${{ secrets.S3_CACHE_ACCESS_KEY }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_CACHE_SECRET_KEY }}
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v1
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Export workspace-relative cache paths
+        run: |
+          echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo"    >> $GITHUB_ENV
+          echo "$GITHUB_WORKSPACE/.cargo/bin"           >> $GITHUB_PATH
+
+      - name: Cache cargo registry
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
-          toolchain: ${{ matrix.rust }}
-          override: true
+          path: |
+            ${{ env.CARGO_HOME }}/registry/index
+            ${{ env.CARGO_HOME }}/registry/cache
+            ${{ env.CARGO_HOME }}/git/db
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
+
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install ${{ matrix.rust }} --profile minimal
+          rustup default ${{ matrix.rust }}
+
       - name: Build
-        uses: actions-rs/cargo@v1
         # Force to build without warnings
         env:
           RUSTFLAGS: '-D warnings'
-        with:
-          command: build
-          args: --verbose --no-default-features --features ${{ matrix.features }}
+        run: cargo build --verbose --no-default-features --features ${{ matrix.features }}
+
       - name: Run tests
-        uses: actions-rs/cargo@v1
-        # force to build tests without warnings
+        # Force to build tests without warnings
         env:
           RUSTFLAGS: '-D warnings'
+        run: cargo test --verbose --no-default-features --features ${{ matrix.features }}
+
+      - name: Show sccache stats
+        if: always()
+        run: sccache --show-stats
+
+  clippy:
+
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:large
+
+    container: public.ecr.aws/docker/library/rust:1
+
+    strategy:
+      matrix:
+        features: ["default", "sync,tls-rustls-ring"]
+
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTC_WRAPPER: sccache
+      SCCACHE_BUCKET: defguard-gh-build-cache
+      SCCACHE_REGION: eu-central-1
+      AWS_ACCESS_KEY_ID: ${{ secrets.S3_CACHE_ACCESS_KEY }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_CACHE_SECRET_KEY }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Export workspace-relative cache paths
+        run: |
+          echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo"    >> $GITHUB_ENV
+          echo "$GITHUB_WORKSPACE/.cargo/bin"           >> $GITHUB_PATH
+
+      - name: Cache cargo registry
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
-          command: test
-          args: --verbose --no-default-features --features ${{ matrix.features }}
+          path: |
+            ${{ env.CARGO_HOME }}/registry/index
+            ${{ env.CARGO_HOME }}/registry/cache
+            ${{ env.CARGO_HOME }}/git/db
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
+
+      - name: Run clippy linter
+        run: |
+          rustup component add clippy
+          cargo clippy --all-targets --no-default-features --features ${{ matrix.features }} -- -D warnings
+
+      - name: Show sccache stats
+        if: always()
+        run: sccache --show-stats
 
   rustfmt_check:
 
-    runs-on: ubuntu-latest
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:small
+
+    container: public.ecr.aws/docker/library/rust:1
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v1
-      - name: Ensure that rustfmt is installed
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-          components: rustfmt
-      - name: Run rustfmt
-        uses: actions-rs/cargo@v1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Check format
+        run: |
+          rustup component add rustfmt
+          cargo fmt --all -- --check
+
+  cargo_deny:
+
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:small
+
+    container: public.ecr.aws/docker/library/rust:1
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@3235f8901fd37ffed0052b276cec25a362fb82e9 # v2
         with:
-          command: fmt
-          args: --all -- --check
+          tool: cargo-deny
 
+      - name: Run cargo deny
+        run: cargo deny check

deny.toml

@@ -0,0 +1,40 @@
+[graph]
+all-features = true
+
+[advisories]
+version = 2
+ignore = [
+    # No constant-time RSA implementation is available yet; reachable only
+    # through the optional sspi (NTLM) dependency, not the default build.
+    { id = "RUSTSEC-2023-0071", reason = "https://github.com/RustCrypto/RSA/issues/19" },
+]
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "MPL-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "Unicode-3.0",
+    "Zlib",
+    "ISC",
+    "BSL-1.0",
+    "0BSD",
+    "CC0-1.0",
+    "OpenSSL",
+    "CDLA-Permissive-2.0",
+    "NCSA",
+]
+confidence-threshold = 0.8
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

examples/add_sync.rs

@@ -20,6 +20,6 @@ fn main() -> Result<()> {
             ],
         )?
         .success()?;
-    println!("{:?}", res);
-    Ok(ldap.unbind()?)
+    println!("{res:?}");
+    ldap.unbind()
 }

examples/bind_sync.rs

@@ -9,5 +9,5 @@ fn main() -> Result<()> {
     let _res = ldap
         .simple_bind("cn=Manager,dc=example,dc=org", "secret")?
         .success()?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/bind_sync_tcp_stream.rs

@@ -13,5 +13,5 @@ fn main() -> Result<()> {
     let _res = ldap
         .simple_bind("cn=Manager,dc=example,dc=org", "secret")?
         .success()?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/compare_sync.rs

@@ -15,5 +15,5 @@ fn main() -> Result<()> {
         )?
         .equal()?;
     println!("{}equal", if eq { "" } else { "not " });
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/connect_tls_ipaddr_sync.rs

@@ -8,5 +8,5 @@ fn main() -> Result<()> {
         LdapConnSettings::new().set_no_tls_verify(true),
         "ldaps://127.0.0.1:2636",
     )?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/moddn_sync.rs

@@ -26,8 +26,8 @@ fn main() -> Result<()> {
         "next" => (NEXT_RDN, TEST_RDN),
         _ => panic!("unexpected uid"),
     };
-    let dn = format!("{},ou=People,dc=example,dc=org", cur_rdn);
+    let dn = format!("{cur_rdn},ou=People,dc=example,dc=org");
     let res = ldap.modifydn(&dn, new_rdn, true, None)?.success()?;
-    println!("{:?}", res);
-    Ok(ldap.unbind()?)
+    println!("{res:?}");
+    ldap.unbind()
 }

examples/modify_relax_sync.rs

@@ -43,6 +43,6 @@ fn main() -> Result<()> {
         .with_controls(RelaxRules.critical())
         .modify("uid=inejge,ou=People,dc=example,dc=org", mod_vec)?
         .success()?;
-    println!("{:?}", res);
-    Ok(ldap.unbind()?)
+    println!("{res:?}");
+    ldap.unbind()
 }

examples/search_abandon.rs

@@ -23,11 +23,10 @@ async fn main() -> Result<()> {
             vec!["l"],
         )
         .await?;
-    while let Some(_r) = stream.next().await? {
-        break;
-    }
+    // Fetch a single entry, then abandon the rest of the search.
+    let _ = stream.next().await?;
     let _res = stream.finish().await;
     let msgid = stream.ldap_handle().last_id();
     ldap.abandon(msgid).await?;
-    Ok(ldap.unbind().await?)
+    ldap.unbind().await
 }

examples/search_adapted.rs

@@ -22,10 +22,10 @@ async fn main() -> Result<()> {
         .await?;
     while let Some(entry) = search.next().await? {
         let entry = SearchEntry::construct(entry);
-        println!("{:?}", entry);
+        println!("{entry:?}");
     }
     let res = search.finish().await.success()?;
-    println!("{:?}", res);
+    println!("{res:?}");
     println!("--- all objects");
     let mut search = ldap
         .streaming_search(
@@ -40,10 +40,10 @@ async fn main() -> Result<()> {
             println!("refs: {:?}", parse_refs(entry.0));
         } else {
             let entry = SearchEntry::construct(entry);
-            println!("{:?}", entry);
+            println!("{entry:?}");
         }
     }
     let res = search.finish().await.success()?;
-    println!("{:?}", res);
-    Ok(ldap.unbind().await?)
+    println!("{res:?}");
+    ldap.unbind().await
 }

examples/search_adapted_paged_plus.rs

@@ -26,8 +26,8 @@ async fn main() -> Result<()> {
         .await?;
     while let Some(entry) = search.next().await? {
         let entry = SearchEntry::construct(entry);
-        println!("{:?}", entry);
+        println!("{entry:?}");
     }
     let _res = search.finish().await.success()?;
-    Ok(ldap.unbind().await?)
+    ldap.unbind().await
 }

examples/search_adapted_paged_plus_sync.rs

@@ -23,8 +23,8 @@ fn main() -> Result<()> {
     )?;
     while let Some(entry) = search.next()? {
         let entry = SearchEntry::construct(entry);
-        println!("{:?}", entry);
+        println!("{entry:?}");
     }
     let _res = search.result().success()?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/search_entrystream_sync.rs

@@ -20,7 +20,7 @@ fn main() -> Result<()> {
     )?;
     while let Some(entry) = search.next()? {
         let entry = SearchEntry::construct(entry);
-        println!("{:?}", entry);
+        println!("{entry:?}");
     }
     // The following two statements show how one would
     // Abandon a Search. The statements are commented out
@@ -33,5 +33,5 @@ fn main() -> Result<()> {
     //let msgid = search.last_id();
     //ldap.abandon(msgid)?;
     let _res = search.result().success()?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/search_starttls_noverify.rs

@@ -28,8 +28,8 @@ async fn main() -> Result<()> {
         .await?;
     while let Some(entry) = search.next().await? {
         let entry = SearchEntry::construct(entry);
-        println!("{:?}", entry);
+        println!("{entry:?}");
     }
     let _res = search.finish().await.success()?;
-    Ok(ldap.unbind().await?)
+    ldap.unbind().await
 }

examples/search_url_params_sync.rs

@@ -22,5 +22,5 @@ fn main() -> Result<()> {
     for entry in rs {
         println!("{:?}", SearchEntry::construct(entry));
     }
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/txn_sync.rs

@@ -42,7 +42,7 @@ fn main() -> Result<()> {
 
     if expo.val.is_some() {
         let end_txn = expo.parse::<EndTxnResp>();
-        println!("{:?}", end_txn);
+        println!("{end_txn:?}");
     }
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }