dirsrvtests/data/ticket47953.ldif | 27 ++++
dirsrvtests/tickets/ticket47953_test.py | 178 ++++++++++++++++++++++++++++++++
ldap/servers/plugins/acl/acl.c | 7 -
3 files changed, 209 insertions(+), 3 deletions(-)
New commits:
commit 6b4ade8cac69d2d903340ec5af4e6b7a93158136
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Nov 12 11:07:52 2014 -0500
Ticket 47953 - testcase for removing invalid aci
https://fedorahosted.org/389/ticket/47953
Reviewed by: rmeggins(Thanks!)
diff --git a/dirsrvtests/data/ticket47953.ldif b/dirsrvtests/data/ticket47953.ldif
new file mode 100644
index 0000000..e59977e
--- /dev/null
+++ b/dirsrvtests/data/ticket47953.ldif
@@ -0,0 +1,27 @@
+dn: dc=example,dc=com
+objectClass: top
+objectClass: domain
+dc: example
+aci: (targetattr!="userPassword")(version 3.0; acl "Enable anonymous
access";
+ allow (read, search, compare) userdn="ldap:///anyone";)
+aci: (targetattr="carLicense || description || displayName || facsimileTelepho
+ neNumber || homePhone || homePostalAddress || initials || jpegPhoto || labele
+ dURI || mail || mobile || pager || photo || postOfficeBox || postalAddress ||
+ postalCode || preferredDeliveryMethod || preferredLanguage || registeredAddr
+ ess || roomNumber || secretary || seeAlso || st || street || telephoneNumber
+ || telexNumber || title || userCertificate || userPassword || userSMIMECertif
+ icate || x500UniqueIdentifier")(version 3.0; acl "Enable self write for commo
+ n attributes"; allow (write) userdn="ldap:///self";)
+aci: (targetattr ="fffff")(version 3.0;acl "Directory Administrators
Group";al
+ low (all) (groupdn = "ldap:///cn=Directory Administrators, dc=example,dc=com"
+ );)
+aci: (targetattr="*")(version 3.0; acl "Configuration Administrators
Group"; a
+ llow (all) groupdn="ldap:///cn=Configuration Administrators,ou=Groups,ou=Topo
+ logyManagement,o=NetscapeRoot";)
+aci: (targetattr="*")(version 3.0; acl "Configuration Administrator";
allow (a
+ ll) userdn="ldap:///uid=admin,ou=Administrators,ou=TopologyManagement,o=Netsc
+ apeRoot";)
+aci: (targetattr = "*")(version 3.0; acl "TEST ACI"; allow (writ
+ e) groupdn = "ldap:///cn=slapd-localhost,cn=389 Directory Server,cn=Server Gr
+ oup,cn=localhost.localdomain,ou=example.com,o=NetscapeRoot";)
+
diff --git a/dirsrvtests/tickets/ticket47953_test.py
b/dirsrvtests/tickets/ticket47953_test.py
new file mode 100644
index 0000000..5a1241b
--- /dev/null
+++ b/dirsrvtests/tickets/ticket47953_test.py
@@ -0,0 +1,178 @@
+import os
+import sys
+import time
+import ldap
+import logging
+import socket
+import pytest
+from lib389 import DirSrv, Entry, tools, tasks
+from lib389.tools import DirSrvTools
+from lib389._constants import *
+from lib389.properties import *
+from lib389.tasks import *
+from constants import *
+
+log = logging.getLogger(__name__)
+
+installation_prefix = None
+
+
+class TopologyStandalone(object):
+ def __init__(self, standalone):
+ standalone.open()
+ self.standalone = standalone
+
+
+(a)pytest.fixture(scope="module")
+def topology(request):
+ '''
+ This fixture is used to standalone topology for the 'module'.
+ At the beginning, It may exists a standalone instance.
+ It may also exists a backup for the standalone instance.
+
+ Principle:
+ If standalone instance exists:
+ restart it
+ If backup of standalone exists:
+ create/rebind to standalone
+
+ restore standalone instance from backup
+ else:
+ Cleanup everything
+ remove instance
+ remove backup
+ Create instance
+ Create backup
+ '''
+ global installation_prefix
+
+ if installation_prefix:
+ args_instance[SER_DEPLOYED_DIR] = installation_prefix
+
+ standalone = DirSrv(verbose=False)
+
+ # Args for the standalone instance
+ args_instance[SER_HOST] = HOST_STANDALONE
+ args_instance[SER_PORT] = PORT_STANDALONE
+ args_instance[SER_SERVERID_PROP] = SERVERID_STANDALONE
+ args_standalone = args_instance.copy()
+ standalone.allocate(args_standalone)
+
+ # Get the status of the backups
+ backup_standalone = standalone.checkBackupFS()
+
+ # Get the status of the instance and restart it if it exists
+ instance_standalone = standalone.exists()
+ if instance_standalone:
+ # assuming the instance is already stopped, just wait 5 sec max
+ standalone.stop(timeout=5)
+ standalone.start(timeout=10)
+
+ if backup_standalone:
+ # The backup exist, assuming it is correct
+ # we just re-init the instance with it
+ if not instance_standalone:
+ standalone.create()
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # restore standalone instance from backup
+ standalone.stop(timeout=10)
+ standalone.restoreFS(backup_standalone)
+ standalone.start(timeout=10)
+
+ else:
+ # We should be here only in two conditions
+ # - This is the first time a test involve standalone instance
+ # - Something weird happened (instance/backup destroyed)
+ # so we discard everything and recreate all
+
+ # Remove the backup. So even if we have a specific backup file
+ # (e.g backup_standalone) we clear backup that an instance may have created
+ if backup_standalone:
+ standalone.clearBackupFS()
+
+ # Remove the instance
+ if instance_standalone:
+ standalone.delete()
+
+ # Create the instance
+ standalone.create()
+
+ # Used to retrieve configuration information (dbdir, confdir...)
+ standalone.open()
+
+ # Time to create the backups
+ standalone.stop(timeout=10)
+ standalone.backupfile = standalone.backupFS()
+ standalone.start(timeout=10)
+
+ # clear the tmp directory
+ standalone.clearTmpDir(__file__)
+
+ #
+ # Here we have standalone instance up and running
+ # Either coming from a backup recovery
+ # or from a fresh (re)init
+ # Time to return the topology
+ return TopologyStandalone(standalone)
+
+
+def test_ticket47953(topology):
+ """
+ Test that we can delete an aci that has an invalid syntax.
+ Sart by importing an ldif with a "bad" aci, then simply try
+ to remove that value without error.
+ """
+
+ log.info('Testing Ticket 47953 - Test we can delete aci that has invalid
syntax')
+
+ #
+ # Import an invalid ldif
+ #
+ ldif_file = topology.standalone.getDir(__file__, DATA_DIR) +
"ticket47953.ldif"
+ importTask = Tasks(topology.standalone)
+ args = {TASK_WAIT: True}
+ try:
+ importTask.importLDIF(DEFAULT_SUFFIX, None, ldif_file, args)
+ except ValueError:
+ assert False
+
+ #
+ # Delete the invalid aci
+ #
+ acival = '(targetattr ="fffff")(version 3.0;acl "Directory
Administrators Group"' + \
+ ';allow (all) (groupdn = "ldap:///cn=Directory Administrators,
dc=example,dc=com");)'
+
+ log.info('Attempting to remove invalid aci...')
+ try:
+ topology.standalone.modify_s(DEFAULT_SUFFIX, [(ldap.MOD_DELETE, 'aci',
acival)])
+ log.info('Removed invalid aci.')
+ except ldap.LDAPError, e:
+ log.error('Failed to remove invalid aci: ' + e.message['desc'])
+ assert False
+
+ # If we got here we passed!
+ log.info('Ticket47953 Test - Passed')
+
+
+def test_ticket47953_final(topology):
+ topology.standalone.stop(timeout=10)
+
+
+def run_isolated():
+ '''
+ run_isolated is used to run these test cases independently of a test scheduler
(xunit, py.test..)
+ To run isolated without py.test, you need to
+ - edit this file and comment '(a)pytest.fixture' line before
'topology' function.
+ - set the installation prefix
+ - run this program
+ '''
+ global installation_prefix
+ installation_prefix = None
+
+ topo = topology(True)
+ test_ticket47953(topo)
+
+if __name__ == '__main__':
+ run_isolated()
\ No newline at end of file
commit 3ce60db0a404b4663df6005b78027332d0e56f95
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Wed Nov 12 10:15:46 2014 -0500
Ticket 47953 - Should not check aci syntax when deleting an aci
Bug Description: Trying to delete an aci that has an invalid sytenx, generates a
syntax error when trying to remove it.
Fix Description: Do not check the syntax of an aci if it's being deleted.
https://fedorahosted.org/389/ticket/47953
Reviewed by: ?
diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c
index fe863c8..5416330 100644
--- a/ldap/servers/plugins/acl/acl.c
+++ b/ldap/servers/plugins/acl/acl.c
@@ -1553,11 +1553,12 @@ acl_check_mods(
/* Are we adding/replacing a aci attribute
** value. In that case, we need to make
- ** sure that the new value has thr right
+ ** sure that the new value has the right
** syntax
*/
- if (strcmp(mod->mod_type,
- aci_attr_type) == 0) {
+ if (!SLAPI_IS_MOD_DELETE(mod->mod_op) &&
+ strcmp(mod->mod_type, aci_attr_type) == 0)
+ {
if ( 0 != (rv = acl_verify_syntax(pb, e_sdn,
mod->mod_bvalues[i], errbuf))) {
aclutil_print_err(rv, e_sdn,