|
 |
a67eaf |
diff -up sudo-1.8.6p7/plugins/sudoers/ldap.c.ldapusermatchfix sudo-1.8.6p7/plugins/sudoers/ldap.c
|
|
|
a67eaf |
--- sudo-1.8.6p7/plugins/sudoers/ldap.c.ldapusermatchfix 2016-05-09 15:33:10.933510674 +0200
|
|
|
a67eaf |
+++ sudo-1.8.6p7/plugins/sudoers/ldap.c 2016-05-09 15:33:10.937510618 +0200
|
|
|
a67eaf |
@@ -2735,22 +2735,37 @@ sudo_ldap_result_get(struct sudo_nss *ns
|
|
|
a67eaf |
result = NULL;
|
|
|
a67eaf |
rc = ldap_search_ext_s(ld, base->val, LDAP_SCOPE_SUBTREE, filt,
|
|
|
a67eaf |
NULL, 0, NULL, NULL, tvp, 0, &result);
|
|
|
a67eaf |
- if (rc != LDAP_SUCCESS) {
|
|
|
a67eaf |
+ if (rc != LDAP_SUCCESS || result == NULL) {
|
|
|
a67eaf |
DPRINTF(("nothing found for '%s'", filt), 1);
|
|
|
a67eaf |
continue;
|
|
|
a67eaf |
}
|
|
|
a67eaf |
- lres->user_matches = true;
|
|
|
a67eaf |
+
|
|
|
a67eaf |
+ DPRINTF(("search result has %d entries (do_netgr=%s)",
|
|
|
a67eaf |
+ ldap_count_entries(ld, result), do_netgr ? "true" : "false"), 1);
|
|
|
a67eaf |
+ /*
|
|
|
a67eaf |
+ * Only set user_matches if we got some results back and if we are
|
|
|
a67eaf |
+ * NOT searching for netgroup entries. For the netgroup case, user_maches
|
|
|
a67eaf |
+ * will be set only if a netgroup match was found.
|
|
|
a67eaf |
+ */
|
|
|
a67eaf |
+ lres->user_matches = lres->user_matches ? true : ldap_count_entries(ld, result) > 0 && !do_netgr;
|
|
|
a67eaf |
|
|
|
a67eaf |
/* Add the seach result to list of search results. */
|
|
|
a67eaf |
DPRINTF(("adding search result"), 1);
|
|
|
a67eaf |
sudo_ldap_result_add_search(lres, ld, result);
|
|
|
a67eaf |
LDAP_FOREACH(entry, ld, result) {
|
|
|
a67eaf |
- if ((!do_netgr ||
|
|
|
a67eaf |
- sudo_ldap_check_user_netgroup(ld, entry, pw->pw_name)) &&
|
|
|
a67eaf |
+ if (do_netgr) {
|
|
|
a67eaf |
+ if (sudo_ldap_check_user_netgroup(ld, entry, pw->pw_name) &&
|
|
|
a67eaf |
sudo_ldap_check_host(ld, entry)) {
|
|
|
a67eaf |
- lres->host_matches = true;
|
|
|
a67eaf |
- sudo_ldap_result_add_entry(lres, entry);
|
|
|
a67eaf |
+ lres->host_matches = true;
|
|
|
a67eaf |
+ lres->user_matches = true;
|
|
|
a67eaf |
+ sudo_ldap_result_add_entry(lres, entry);
|
|
|
a67eaf |
+ }
|
|
|
a67eaf |
+ } else {
|
|
|
a67eaf |
+ if (sudo_ldap_check_host(ld, entry)) {
|
|
|
a67eaf |
+ lres->host_matches = true;
|
|
|
a67eaf |
+ sudo_ldap_result_add_entry(lres, entry);
|
|
|
a67eaf |
}
|
|
|
a67eaf |
+ }
|
|
|
a67eaf |
}
|
|
|
a67eaf |
DPRINTF(("result now has %d entries", lres->nentries), 1);
|
|
|
a67eaf |
}
|