|
 |
23314f |
From 24eeccd408d9627299231d7843ca9e65e71af3de Mon Sep 17 00:00:00 2001
|
|
|
23314f |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
23314f |
Date: Tue, 21 Mar 2023 17:32:47 +0200
|
|
|
23314f |
Subject: [PATCH 1/2] Test the case when container is a child of the target DN
|
|
|
23314f |
|
|
|
23314f |
We can have target DN both inside or outside of a container.
|
|
|
23314f |
Previously, the code did not look into the latter one. When container is
|
|
|
23314f |
a child of the target DN (like using IPA's base DN instead of
|
|
|
23314f |
cn=compat,$BASE_DN) and a search was done with a subtree scope, the
|
|
|
23314f |
check failed.
|
|
|
23314f |
|
|
|
23314f |
With this change a subtree scope search which starts with a base DN
|
|
|
23314f |
that includes a compat tree's container would be considered for the
|
|
|
23314f |
search.
|
|
|
23314f |
|
|
|
23314f |
Fixes: rhbz#2168893
|
|
|
23314f |
|
|
|
23314f |
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
23314f |
---
|
|
|
23314f |
src/back-sch.c | 9 +++++----
|
|
|
23314f |
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
23314f |
|
|
|
23314f |
diff --git a/src/back-sch.c b/src/back-sch.c
|
|
|
23314f |
index 93746b1..e447bda 100644
|
|
|
23314f |
--- a/src/back-sch.c
|
|
|
23314f |
+++ b/src/back-sch.c
|
|
|
23314f |
@@ -1340,11 +1340,12 @@ backend_search_find_set_dn_in_group_cb(const char *group, const char *set, bool_
|
|
|
23314f |
|
|
|
23314f |
if (slapi_sdn_scope_test(cbdata->target_dn,
|
|
|
23314f |
set_data->container_sdn,
|
|
|
23314f |
- cbdata->scope) == 1) {
|
|
|
23314f |
+ cbdata->scope) != 0) {
|
|
|
23314f |
cbdata->answer = TRUE;
|
|
|
23314f |
- }
|
|
|
23314f |
-
|
|
|
23314f |
- if (slapi_sdn_issuffix(cbdata->target_dn, set_data->container_sdn) == 1) {
|
|
|
23314f |
+ } else if ((cbdata->scope == LDAP_SCOPE_SUBTREE) &&
|
|
|
23314f |
+ slapi_sdn_scope_test(set_data->container_sdn,
|
|
|
23314f |
+ cbdata->target_dn,
|
|
|
23314f |
+ cbdata->scope) != 0) {
|
|
|
23314f |
cbdata->answer = TRUE;
|
|
|
23314f |
}
|
|
|
23314f |
|
|
|
23314f |
--
|
|
|
23314f |
2.40.0
|
|
|
23314f |
|
|
|
23314f |
|
|
|
23314f |
From 73058645eac86b40913deec01807854e0a8bda0d Mon Sep 17 00:00:00 2001
|
|
|
23314f |
From: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
23314f |
Date: Mon, 24 Apr 2023 12:19:10 +0300
|
|
|
23314f |
Subject: [PATCH 2/2] Identify the container without search base check
|
|
|
23314f |
|
|
|
23314f |
Ignore the actual search base when identifying whether a target DN is
|
|
|
23314f |
within a known data container. The reason is that we need to know
|
|
|
23314f |
whether a search would have to descent into a particular container. The
|
|
|
23314f |
scope validation will happen later.
|
|
|
23314f |
|
|
|
23314f |
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
23314f |
---
|
|
|
23314f |
src/back-sch.c | 2 +-
|
|
|
23314f |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
23314f |
|
|
|
23314f |
diff --git a/src/back-sch.c b/src/back-sch.c
|
|
|
23314f |
index e447bda..a79f61b 100644
|
|
|
23314f |
--- a/src/back-sch.c
|
|
|
23314f |
+++ b/src/back-sch.c
|
|
|
23314f |
@@ -1340,7 +1340,7 @@ backend_search_find_set_dn_in_group_cb(const char *group, const char *set, bool_
|
|
|
23314f |
|
|
|
23314f |
if (slapi_sdn_scope_test(cbdata->target_dn,
|
|
|
23314f |
set_data->container_sdn,
|
|
|
23314f |
- cbdata->scope) != 0) {
|
|
|
23314f |
+ LDAP_SCOPE_SUBTREE) != 0) {
|
|
|
23314f |
cbdata->answer = TRUE;
|
|
|
23314f |
} else if ((cbdata->scope == LDAP_SCOPE_SUBTREE) &&
|
|
|
23314f |
slapi_sdn_scope_test(set_data->container_sdn,
|
|
|
23314f |
--
|
|
|
23314f |
2.40.0
|
|
|
23314f |
|