|
 |
dc8c34 |
From 0baf2db04d66872e7dfa7e1c62432777d4ba48e8 Mon Sep 17 00:00:00 2001
|
|
|
dc8c34 |
From: Mark Reynolds <mreynolds@redhat.com>
|
|
|
dc8c34 |
Date: Fri, 13 Jan 2017 11:08:18 -0500
|
|
|
dc8c34 |
Subject: [PATCH 427/427] Ticket 49072 - memberof fixup is not validating base
|
|
|
dc8c34 |
dn
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Description: The basedn validation was not correctly backported to 1.2.11.
|
|
|
dc8c34 |
This patch adds the appropriate checks.
|
|
|
dc8c34 |
|
|
|
dc8c34 |
https://fedorahosted.org/389/ticket/49072
|
|
|
dc8c34 |
|
|
|
dc8c34 |
Reviewed by: nhosoi(Thanks!)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
(cherry picked from commit a87ddab64870a70b54eab8964ae1cdea9c5689b9)
|
|
|
dc8c34 |
---
|
|
|
dc8c34 |
ldap/servers/plugins/memberof/memberof.c | 18 +++++++++++++++++-
|
|
|
dc8c34 |
ldap/servers/slapd/mapping_tree.c | 20 ++++++++++++++++++++
|
|
|
dc8c34 |
ldap/servers/slapd/slapi-plugin.h | 1 +
|
|
|
dc8c34 |
3 files changed, 38 insertions(+), 1 deletion(-)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
diff --git a/ldap/servers/plugins/memberof/memberof.c b/ldap/servers/plugins/memberof/memberof.c
|
|
|
dc8c34 |
index 2cdaabb..aa54922 100644
|
|
|
dc8c34 |
--- a/ldap/servers/plugins/memberof/memberof.c
|
|
|
dc8c34 |
+++ b/ldap/servers/plugins/memberof/memberof.c
|
|
|
dc8c34 |
@@ -2282,10 +2282,11 @@ void memberof_fixup_task_thread(void *arg)
|
|
|
dc8c34 |
{
|
|
|
dc8c34 |
MemberOfConfig configCopy = {0, 0, 0, 0};
|
|
|
dc8c34 |
Slapi_Task *task = (Slapi_Task *)arg;
|
|
|
dc8c34 |
+ Slapi_DN *sdn;
|
|
|
dc8c34 |
+ Slapi_Backend *be;
|
|
|
dc8c34 |
task_data *td = NULL;
|
|
|
dc8c34 |
int rc = 0;
|
|
|
dc8c34 |
|
|
|
dc8c34 |
-
|
|
|
dc8c34 |
if (!task) {
|
|
|
dc8c34 |
return; /* no task */
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
@@ -2302,6 +2303,20 @@ void memberof_fixup_task_thread(void *arg)
|
|
|
dc8c34 |
slapi_log_error(SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM,
|
|
|
dc8c34 |
"Memberof task starts (filter: \"%s\") ...\n", td->filter_str);
|
|
|
dc8c34 |
|
|
|
dc8c34 |
+ /* Validate the search base */
|
|
|
dc8c34 |
+ sdn = slapi_sdn_new_dn_byref(td->dn);
|
|
|
dc8c34 |
+ be = slapi_be_select_exact(sdn);
|
|
|
dc8c34 |
+ slapi_sdn_free(&sdn;;
|
|
|
dc8c34 |
+ if (be == NULL) {
|
|
|
dc8c34 |
+ slapi_log_error(SLAPI_LOG_FATAL, MEMBEROF_PLUGIN_SUBSYSTEM,
|
|
|
dc8c34 |
+ "memberof_fixup_task_thread - Failed to get be backend from (%s)\n",
|
|
|
dc8c34 |
+ td->dn);
|
|
|
dc8c34 |
+ slapi_task_log_notice(task, "Memberof task - Failed to get be backend from (%s)\n",
|
|
|
dc8c34 |
+ td->dn);
|
|
|
dc8c34 |
+ rc = -1;
|
|
|
dc8c34 |
+ goto done;
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+
|
|
|
dc8c34 |
/* We need to get the config lock first. Trying to get the
|
|
|
dc8c34 |
* config lock after we already hold the op lock can cause
|
|
|
dc8c34 |
* a deadlock. */
|
|
|
dc8c34 |
@@ -2324,6 +2339,7 @@ void memberof_fixup_task_thread(void *arg)
|
|
|
dc8c34 |
|
|
|
dc8c34 |
memberof_free_config(&configCopy);
|
|
|
dc8c34 |
|
|
|
dc8c34 |
+done:
|
|
|
dc8c34 |
slapi_task_log_notice(task, "Memberof task finished.");
|
|
|
dc8c34 |
slapi_task_log_status(task, "Memberof task finished.");
|
|
|
dc8c34 |
slapi_task_inc_progress(task);
|
|
|
dc8c34 |
diff --git a/ldap/servers/slapd/mapping_tree.c b/ldap/servers/slapd/mapping_tree.c
|
|
|
dc8c34 |
index 841ed32..f9dfcb9 100644
|
|
|
dc8c34 |
--- a/ldap/servers/slapd/mapping_tree.c
|
|
|
dc8c34 |
+++ b/ldap/servers/slapd/mapping_tree.c
|
|
|
dc8c34 |
@@ -3039,6 +3039,26 @@ slapi_be_select( const Slapi_DN *sdn ) /* JCM - The name of this should change??
|
|
|
dc8c34 |
return be;
|
|
|
dc8c34 |
}
|
|
|
dc8c34 |
|
|
|
dc8c34 |
+Slapi_Backend *
|
|
|
dc8c34 |
+slapi_be_select_exact(const Slapi_DN *sdn)
|
|
|
dc8c34 |
+{
|
|
|
dc8c34 |
+ Slapi_Backend *be = NULL;
|
|
|
dc8c34 |
+ mapping_tree_node *node = NULL;
|
|
|
dc8c34 |
+
|
|
|
dc8c34 |
+ if (!sdn) {
|
|
|
dc8c34 |
+ slapi_log_error(SLAPI_LOG_FATAL, "slapi_be_select_exact",
|
|
|
dc8c34 |
+ "Empty Slapi_DN is given.\n");
|
|
|
dc8c34 |
+ return NULL;
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+ node = slapi_get_mapping_tree_node_by_dn(sdn);
|
|
|
dc8c34 |
+
|
|
|
dc8c34 |
+ if (node && node->mtn_be) {
|
|
|
dc8c34 |
+ be = node->mtn_be[0];
|
|
|
dc8c34 |
+ }
|
|
|
dc8c34 |
+
|
|
|
dc8c34 |
+ return be;
|
|
|
dc8c34 |
+}
|
|
|
dc8c34 |
+
|
|
|
dc8c34 |
/* Check if the dn targets an internal reserved backends */
|
|
|
dc8c34 |
int
|
|
|
dc8c34 |
slapi_on_internal_backends(const Slapi_DN *sdn)
|
|
|
dc8c34 |
diff --git a/ldap/servers/slapd/slapi-plugin.h b/ldap/servers/slapd/slapi-plugin.h
|
|
|
dc8c34 |
index c36822d..7f36173 100644
|
|
|
dc8c34 |
--- a/ldap/servers/slapd/slapi-plugin.h
|
|
|
dc8c34 |
+++ b/ldap/servers/slapd/slapi-plugin.h
|
|
|
dc8c34 |
@@ -6051,6 +6051,7 @@ Slapi_Backend *slapi_be_new( const char *type, const char *name,
|
|
|
dc8c34 |
int isprivate, int logchanges );
|
|
|
dc8c34 |
void slapi_be_free(Slapi_Backend **be);
|
|
|
dc8c34 |
Slapi_Backend *slapi_be_select( const Slapi_DN *sdn );
|
|
|
dc8c34 |
+Slapi_Backend *slapi_be_select_exact(const Slapi_DN *sdn);
|
|
|
dc8c34 |
Slapi_Backend *slapi_be_select_by_instance_name( const char *name );
|
|
|
dc8c34 |
int slapi_be_exist(const Slapi_DN *sdn);
|
|
|
dc8c34 |
void slapi_be_delete_onexit(Slapi_Backend *be);
|
|
|
dc8c34 |
--
|
|
|
dc8c34 |
2.9.3
|
|
|
dc8c34 |
|