ldap/servers/plugins/acl/aclparse.c | 19 +++++++++++++------
ldap/servers/plugins/acl/aclutil.c | 2 +-
ldap/servers/slapd/back-ldbm/ldbm_add.c | 2 +-
ldap/servers/slapd/back-ldbm/ldbm_modify.c | 2 +-
ldap/servers/slapd/back-ldbm/ldbm_modrdn.c | 4 ++--
5 files changed, 18 insertions(+), 11 deletions(-)
New commits:
commit 07c1bc25508a9c1e71dd8e717fd4ce455ddfeff0
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Fri Oct 10 11:50:13 2014 -0700
Ticket #47922 - dynamically added macro aci is not evaluated on the fly
Bug Description: When macro aci is dynamically added and if the aci's
macro target dn is not normalized, the following operation that requires
the aci could fail with Insufficient access since matching the target dn
and the macro target dn fails since the code expects normalized macro
target dn.
Fix Description: Before setting the macro target dn, process the dn by
slapi_create_dn_string_case.
https://fedorahosted.org/389/ticket/47922
Reviewed by lkrispen(a)redhat.com and rmeggins(a)redhat.com (Thank you, Ludwig and
Rich!!)
diff --git a/ldap/servers/plugins/acl/aclparse.c b/ldap/servers/plugins/acl/aclparse.c
index ea64fa7..be86c8b 100644
--- a/ldap/servers/plugins/acl/aclparse.c
+++ b/ldap/servers/plugins/acl/aclparse.c
@@ -1849,9 +1849,9 @@ static int
acl_check_for_target_macro( aci_t *aci_item, char *value)
{
- char *str = NULL;
+ char *str = NULL;
- str = strstr(value, ACL_TARGET_MACRO_DN_KEY /* ($dn) */);
+ str = PL_strcasestr(value, ACL_TARGET_MACRO_DN_KEY /* ($dn) */);
if (str != NULL) {
char *p0 = NULL, *p1 = NULL;
@@ -1871,10 +1871,17 @@ acl_check_for_target_macro( aci_t *aci_item, char *value)
aci_item->aci_type &= ~ACI_TARGET_DN;
aci_item->aci_type |= ACI_TARGET_MACRO_DN;
aci_item->aci_macro = (aciMacro *)slapi_ch_malloc(sizeof(aciMacro));
- aci_item->aci_macro->match_this = slapi_ch_strdup(value);
- aci_item->aci_macro->macro_ptr = strstr( aci_item->aci_macro->match_this,
- ACL_TARGET_MACRO_DN_KEY);
- return(1);
+ /* Macro dn needs to normalize. E.g., "ou=Groups, ($dN), dn=example,dn=com"
*/
+ aci_item->aci_macro->match_this = slapi_create_dn_string_case("%s",
value);
+ if (NULL == aci_item->aci_macro->match_this) {
+ slapi_log_error(SLAPI_LOG_FATAL, plugin_name,
+ "acl_check_for_target_macro: Error: Invalid macro target dn:
\"%s\"\n", value);
+ aci_item->aci_type &= ~ACI_TARGET_MACRO_DN;
+ slapi_ch_free((void **)&aci_item->aci_macro);
+ return -1;
+ }
+ aci_item->aci_macro->macro_ptr =
PL_strcasestr(aci_item->aci_macro->match_this, ACL_TARGET_MACRO_DN_KEY);
+ return(1);
}
return(0);
diff --git a/ldap/servers/plugins/acl/aclutil.c b/ldap/servers/plugins/acl/aclutil.c
index e865a95..0720dae 100644
--- a/ldap/servers/plugins/acl/aclutil.c
+++ b/ldap/servers/plugins/acl/aclutil.c
@@ -785,7 +785,7 @@ acl_match_macro_in_target( const char *ndn, char * match_this,
macro_prefix = slapi_ch_strdup(match_this);
/* we know it's got a $(dn) */
- tmp_ptr = strstr(macro_prefix, ACL_TARGET_MACRO_DN_KEY);
+ tmp_ptr = PL_strcasestr(macro_prefix, ACL_TARGET_MACRO_DN_KEY);
if (!tmp_ptr) {
LDAPDebug(LDAP_DEBUG_ACL,"acl_match_macro_in_target: "
"Target macro DN key \"%s\" not found in \"%s\".\n",
commit 2aabb017bd4eec6d30bf00486eb027f59129cf74
Author: Noriko Hosoi <nhosoi(a)redhat.com>
Date: Wed Oct 8 10:38:02 2014 -0700
Ticket #47897 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY,
original_entry->ep_entry) prior to original_entry overwritten
Bug Description: In the DEADLOCK retry code in ldbm_back_modrdn,
SLAPI_MODRDN_EXISTING_ENTRY in pblock is reset with the new entry
to be renamed. The location of the setting entry was inappropriate,
thus instead of the entry, but its backup is set in pblock.
Fix Description: Moving the slapi_pblock_set(SLAPI_MODRDN_EXISTING_
ENTRY) to the correct position.
Plus, in the DEADLOCK retry code, original_entry is duplicated and
used for the next loop. The source of the duplication has to be
the clean entry before updated in the backend code, but in ldbm_add,
ldbm_modify, and ldbm_modrdn, the current entry was duplicated and
set to the original entry, which could have been updated in the
previous loop. This patch fixes it, as well.
https://fedorahosted.org/389/ticket/47897
Reviewed by tbordaz(a)redhat.com (Thank you, Theirry!!)
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_add.c
b/ldap/servers/slapd/back-ldbm/ldbm_add.c
index b74154a..75cb0dc 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_add.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_add.c
@@ -225,7 +225,7 @@ ldbm_back_add( Slapi_PBlock *pb )
slapi_pblock_set(pb, SLAPI_TXN, parent_txn);
/* must duplicate addingentry before returning it to cache,
* which could free the entry. */
- if ( (tmpentry = backentry_dup( addingentry )) == NULL ) {
+ if ((tmpentry = backentry_dup(originalentry?originalentry:addingentry)) == NULL) {
ldap_result_code= LDAP_OPERATIONS_ERROR;
goto error_return;
}
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modify.c
b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
index d15b050..b9f754d 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modify.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modify.c
@@ -521,7 +521,7 @@ ldbm_back_modify( Slapi_PBlock *pb )
if (ec) {
/* must duplicate ec before returning it to cache,
* which could free the entry. */
- if ( (tmpentry = backentry_dup( ec )) == NULL ) {
+ if ((tmpentry = backentry_dup(original_entry?original_entry:ec)) == NULL) {
ldap_result_code= LDAP_OPERATIONS_ERROR;
goto error_return;
}
diff --git a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
index 7bcbcee..6a4982c 100644
--- a/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
+++ b/ldap/servers/slapd/back-ldbm/ldbm_modrdn.c
@@ -275,7 +275,7 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
orig_dn_newsuperiordn = slapi_sdn_dup(orig_dn_newsuperiordn);
/* must duplicate ec before returning it to cache,
* which could free the entry. */
- if ( (tmpentry = backentry_dup( ec )) == NULL ) {
+ if ((tmpentry = backentry_dup(original_entry?original_entry:ec)) == NULL) {
ldap_result_code= LDAP_OPERATIONS_ERROR;
goto error_return;
}
@@ -295,10 +295,10 @@ ldbm_back_modrdn( Slapi_PBlock *pb )
slapi_entry_free(ent);
slapi_pblock_set( pb, SLAPI_MODRDN_EXISTING_ENTRY, NULL );
}
+ slapi_pblock_set( pb, SLAPI_MODRDN_EXISTING_ENTRY,
original_entry->ep_entry );
ec = original_entry;
original_entry = tmpentry;
tmpentry = NULL;
- slapi_pblock_set( pb, SLAPI_MODRDN_EXISTING_ENTRY,
original_entry->ep_entry );
free_modrdn_existing_entry = 0; /* owned by original_entry now */
if (!cache_is_in_cache(&inst->inst_cache, ec)) {
/* Put the resetted entry 'ec' into the cache again. */