Add error handling to hotpaths that may panic

.github/workflows/build.yml

@@ -7,59 +7,160 @@ on:
   pull_request:
     branches:
       - master
+      - dev
+
+permissions:
+  contents: read
 
 jobs:
   build:
 
-    runs-on: ${{ matrix.os }}
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:large
+
+    container: public.ecr.aws/docker/library/rust:1
 
     strategy:
       matrix:
-        os: [ubuntu-latest, windows-2022, macOS-latest]
         rust: [stable, nightly]
         features: ["default", "sync,tls-rustls-ring"]
 
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTC_WRAPPER: sccache
+      SCCACHE_BUCKET: defguard-gh-build-cache
+      SCCACHE_REGION: eu-central-1
+      AWS_ACCESS_KEY_ID: ${{ secrets.S3_CACHE_ACCESS_KEY }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_CACHE_SECRET_KEY }}
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v1
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Export workspace-relative cache paths
+        run: |
+          echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo"    >> $GITHUB_ENV
+          echo "$GITHUB_WORKSPACE/.cargo/bin"           >> $GITHUB_PATH
+
+      - name: Cache cargo registry
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
-          toolchain: ${{ matrix.rust }}
-          override: true
+          path: |
+            ${{ env.CARGO_HOME }}/registry/index
+            ${{ env.CARGO_HOME }}/registry/cache
+            ${{ env.CARGO_HOME }}/git/db
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
+
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install ${{ matrix.rust }} --profile minimal
+          rustup default ${{ matrix.rust }}
+
       - name: Build
-        uses: actions-rs/cargo@v1
         # Force to build without warnings
         env:
           RUSTFLAGS: '-D warnings'
-        with:
-          command: build
-          args: --verbose --no-default-features --features ${{ matrix.features }}
+        run: cargo build --verbose --no-default-features --features ${{ matrix.features }}
+
       - name: Run tests
-        uses: actions-rs/cargo@v1
-        # force to build tests without warnings
+        # Force to build tests without warnings
         env:
           RUSTFLAGS: '-D warnings'
+        run: cargo test --verbose --no-default-features --features ${{ matrix.features }}
+
+      - name: Show sccache stats
+        if: always()
+        run: sccache --show-stats
+
+  clippy:
+
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:large
+
+    container: public.ecr.aws/docker/library/rust:1
+
+    strategy:
+      matrix:
+        features: ["default", "sync,tls-rustls-ring"]
+
+    env:
+      CARGO_TERM_COLOR: always
+      RUSTC_WRAPPER: sccache
+      SCCACHE_BUCKET: defguard-gh-build-cache
+      SCCACHE_REGION: eu-central-1
+      AWS_ACCESS_KEY_ID: ${{ secrets.S3_CACHE_ACCESS_KEY }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_CACHE_SECRET_KEY }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Export workspace-relative cache paths
+        run: |
+          echo "CARGO_HOME=$GITHUB_WORKSPACE/.cargo"    >> $GITHUB_ENV
+          echo "$GITHUB_WORKSPACE/.cargo/bin"           >> $GITHUB_PATH
+
+      - name: Cache cargo registry
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
-          command: test
-          args: --verbose --no-default-features --features ${{ matrix.features }}
+          path: |
+            ${{ env.CARGO_HOME }}/registry/index
+            ${{ env.CARGO_HOME }}/registry/cache
+            ${{ env.CARGO_HOME }}/git/db
+          key: cargo-registry-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
+
+      - name: Run clippy linter
+        run: |
+          rustup component add clippy
+          cargo clippy --all-targets --no-default-features --features ${{ matrix.features }} -- -D warnings
+
+      - name: Show sccache stats
+        if: always()
+        run: sccache --show-stats
 
   rustfmt_check:
 
-    runs-on: ubuntu-latest
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:small
+
+    container: public.ecr.aws/docker/library/rust:1
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v1
-      - name: Ensure that rustfmt is installed
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-          components: rustfmt
-      - name: Run rustfmt
-        uses: actions-rs/cargo@v1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Check format
+        run: |
+          rustup component add rustfmt
+          cargo fmt --all -- --check
+
+  cargo_deny:
+
+    runs-on:
+      - codebuild-defguard-ldap3-runner-${{ github.run_id }}-${{ github.run_attempt }}
+      - instance-size:small
+
+    container: public.ecr.aws/docker/library/rust:1
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@3235f8901fd37ffed0052b276cec25a362fb82e9 # v2
         with:
-          command: fmt
-          args: --all -- --check
+          tool: cargo-deny
 
+      - name: Run cargo deny
+        run: cargo deny check

deny.toml

@@ -0,0 +1,40 @@
+[graph]
+all-features = true
+
+[advisories]
+version = 2
+ignore = [
+    # No constant-time RSA implementation is available yet; reachable only
+    # through the optional sspi (NTLM) dependency, not the default build.
+    { id = "RUSTSEC-2023-0071", reason = "https://github.com/RustCrypto/RSA/issues/19" },
+]
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "MPL-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "Unicode-3.0",
+    "Zlib",
+    "ISC",
+    "BSL-1.0",
+    "0BSD",
+    "CC0-1.0",
+    "OpenSSL",
+    "CDLA-Permissive-2.0",
+    "NCSA",
+]
+confidence-threshold = 0.8
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

examples/add_sync.rs

@@ -2,8 +2,7 @@
 
 use std::collections::HashSet;
 
-use ldap3::LdapConn;
-use ldap3::result::Result;
+use ldap3::{LdapConn, result::Result};
 
 fn main() -> Result<()> {
     let mut ldap = LdapConn::new("ldap://localhost:2389")?;
@@ -20,6 +19,6 @@ fn main() -> Result<()> {
             ],
         )?
         .success()?;
-    println!("{:?}", res);
-    Ok(ldap.unbind()?)
+    println!("{res:?}");
+    ldap.unbind()
 }

examples/bind_sync.rs

@@ -1,13 +1,12 @@
 // Demonstrates synchronously connecting, binding to,
 // and disconnectiong from the server.
 
-use ldap3::LdapConn;
-use ldap3::result::Result;
+use ldap3::{LdapConn, result::Result};
 
 fn main() -> Result<()> {
     let mut ldap = LdapConn::new("ldap://localhost:2389")?;
     let _res = ldap
         .simple_bind("cn=Manager,dc=example,dc=org", "secret")?
         .success()?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/bind_sync_tcp_stream.rs

@@ -3,8 +3,7 @@
 
 use std::net::TcpStream;
 
-use ldap3::result::Result;
-use ldap3::{LdapConn, LdapConnSettings, StdStream};
+use ldap3::{LdapConn, LdapConnSettings, StdStream, result::Result};
 
 fn main() -> Result<()> {
     let stream = TcpStream::connect("localhost:2389")?;
@@ -13,5 +12,5 @@ fn main() -> Result<()> {
     let _res = ldap
         .simple_bind("cn=Manager,dc=example,dc=org", "secret")?
         .success()?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/compare_sync.rs

@@ -1,7 +1,6 @@
 // Demonstrates the Compare operation.
 
-use ldap3::LdapConn;
-use ldap3::result::Result;
+use ldap3::{LdapConn, result::Result};
 
 fn main() -> Result<()> {
     let mut ldap = LdapConn::new("ldap://localhost:2389")?;
@@ -15,5 +14,5 @@ fn main() -> Result<()> {
         )?
         .equal()?;
     println!("{}equal", if eq { "" } else { "not " });
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/connect_tls_ipaddr_sync.rs

@@ -1,12 +1,11 @@
 // Demonstrates TLS connection to an IP address.
 
-use ldap3::result::Result;
-use ldap3::{LdapConn, LdapConnSettings};
+use ldap3::{LdapConn, LdapConnSettings, result::Result};
 
 fn main() -> Result<()> {
     let mut ldap = LdapConn::with_settings(
         LdapConnSettings::new().set_no_tls_verify(true),
         "ldaps://127.0.0.1:2636",
     )?;
-    Ok(ldap.unbind()?)
+    ldap.unbind()
 }

examples/moddn_sync.rs

@@ -1,8 +1,7 @@
 // Demonstrates the ModifyDN operation. The program will query
 // the database to find out which modification make sense.
 
-use ldap3::result::Result;
-use ldap3::{LdapConn, Scope, SearchEntry};
+use ldap3::{LdapConn, Scope, SearchEntry, result::Result};
 
 const TEST_RDN: &str = "uid=test";
 const NEXT_RDN: &str = "uid=next";
@@ -26,8 +25,8 @@ fn main() -> Result<()> {
         "next" => (NEXT_RDN, TEST_RDN),
         _ => panic!("unexpected uid"),
     };
-    let dn = format!("{},ou=People,dc=example,dc=org", cur_rdn);
+    let dn = format!("{cur_rdn},ou=People,dc=example,dc=org");
     let res = ldap.modifydn(&dn, new_rdn, true, None)?.success()?;
-    println!("{:?}", res);
-    Ok(ldap.unbind()?)
+    println!("{res:?}");
+    ldap.unbind()
 }

examples/modify_relax_sync.rs

@@ -8,9 +8,11 @@
 
 use std::collections::HashSet;
 
-use ldap3::controls::{MakeCritical, RelaxRules};
-use ldap3::result::Result;
-use ldap3::{LdapConn, Mod, Scope};
+use ldap3::{
+    LdapConn, Mod, Scope,
+    controls::{MakeCritical, RelaxRules},
+    result::Result,
+};
 
 fn main() -> Result<()> {
     let mut ldap = LdapConn::new("ldap://localhost:2389")?;
@@ -43,6 +45,6 @@ fn main() -> Result<()> {
         .with_controls(RelaxRules.critical())
         .modify("uid=inejge,ou=People,dc=example,dc=org", mod_vec)?
         .success()?;
-    println!("{:?}", res);
-    Ok(ldap.unbind()?)
+    println!("{res:?}");
+    ldap.unbind()
 }

examples/search_abandon.rs

@@ -8,8 +8,7 @@
 // The synchronous API lacks the method to retrieve the underlying
 // Ldap handle, but last_id() can be called directly on the stream.
 
-use ldap3::result::Result;
-use ldap3::{LdapConnAsync, Scope};
+use ldap3::{LdapConnAsync, Scope, result::Result};
 
 #[tokio::main]
 async fn main() -> Result<()> {
@@ -23,11 +22,10 @@ async fn main() -> Result<()> {
             vec!["l"],
         )
         .await?;
-    while let Some(_r) = stream.next().await? {
-        break;
-    }
+    // Fetch a single entry, then abandon the rest of the search.
+    let _ = stream.next().await?;
     let _res = stream.finish().await;
     let msgid = stream.ldap_handle().last_id();
     ldap.abandon(msgid).await?;
-    Ok(ldap.unbind().await?)
+    ldap.unbind().await
 }