[SSSD] [PATCH] AD: Fix ad_access_filter parsing with empty filter

Jakub Hrozek jhrozek at redhat.com
Wed Oct 30 20:43:55 UTC 2013


I'm sorry about the breakage, but if the ad_access_filter was unset yet
access_provider was set to AD, access was denied. Even though the access
order was set correctly to "expire, filter", the filter being NULL
caused problems. A patch including unit test is attached.
-------------- next part --------------
>From 70892384b3d479c43b37a2fc3cf4c5dc032db1a9 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 30 Oct 2013 21:35:18 +0100
Subject: [PATCH] AD: Fix ad_access_filter parsing with empty filter

---
 src/providers/ad/ad_access.c             |  8 ++++++++
 src/tests/cmocka/test_ad_access_filter.c | 16 ++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/src/providers/ad/ad_access.c b/src/providers/ad/ad_access.c
index c16f049424d65b50c306fad7e782570868a664ea..6995172db304810899e538b37572e4ba953db3e7 100644
--- a/src/providers/ad/ad_access.c
+++ b/src/providers/ad/ad_access.c
@@ -169,12 +169,20 @@ ad_parse_access_filter(TALLOC_CTX *mem_ctx,
     int flags;
     TALLOC_CTX *tmp_ctx;
 
+    if (_filter == NULL) return EINVAL;
+
     tmp_ctx = talloc_new(mem_ctx);
     if (tmp_ctx == NULL) {
         ret = ENOMEM;
         goto done;
     }
 
+    if (filter_list == NULL) {
+        *_filter = NULL;
+        ret = EOK;
+        goto done;
+    }
+
     ret = split_on_separator(tmp_ctx, filter_list, '?', true, true,
                              &filters, &nfilters);
     if (ret != EOK) {
diff --git a/src/tests/cmocka/test_ad_access_filter.c b/src/tests/cmocka/test_ad_access_filter.c
index e31f2dc37d7f78b0fa871839a57bd62a09c53944..3f4e44f14150a1a23eda5e7b914ddcee94203c65 100644
--- a/src/tests/cmocka/test_ad_access_filter.c
+++ b/src/tests/cmocka/test_ad_access_filter.c
@@ -99,6 +99,18 @@ done:
     talloc_free(tmp_ctx);
 }
 
+/* Test that setting no filter lets all access through
+ */
+void test_no_filter(void **state)
+{
+    struct filter_parse_result expected = {
+        .result = EOK,
+        .best_match = NULL
+    };
+
+    test_parse_filter_generic(NULL, &expected);
+}
+
 /* Test that if one filter is provided, it is returned as-is
  */
 void test_single_filter(void **state)
@@ -304,6 +316,10 @@ int main(int argc, const char *argv[])
                                  parse_test_setup,
                                  parse_test_teardown),
 
+        unit_test_setup_teardown(test_no_filter,
+                                 ad_access_filter_test_setup,
+                                 ad_access_filter_test_teardown),
+
         unit_test_setup_teardown(test_single_filter,
                                  ad_access_filter_test_setup,
                                  ad_access_filter_test_teardown),
-- 
1.8.3.1



More information about the sssd-devel mailing list