10:29 a.m.
This is an automated email from the git hooks/post-receive script.
mreynolds pushed a commit to branch 389-ds-base-1.3.5
in repository 389-ds-base.
commit 56961beca758c583b34c851226b7da8c5df7f827
Author: Mark Reynolds <mreynolds(a)redhat.com>
Date: Tue May 9 16:31:52 2017 -0400
Ticket 49246 - ns-slapd crashes in role cache creation
Bug Description: Using a nested filter for a filtered role can
cause a crash. This was due to the way the filter
was being checked by the roles plugin.
Fix Description: Properly resurse over a filter.
https://pagure.io/389-ds-base/issue/49246
Reviewed by: firstyear & tbordaz(Thanks!!)
(cherry picked from commit 54e4fca35899550e0c25b25e7f7c756302d258ce)
---
dirsrvtests/tests/tickets/ticket49122_test.py | 63 +++++++++++++++++----------
ldap/servers/plugins/roles/roles_cache.c | 34 +++++++++++----
2 files changed, 67 insertions(+), 30 deletions(-)
diff --git a/dirsrvtests/tests/tickets/ticket49122_test.py
b/dirsrvtests/tests/tickets/ticket49122_test.py
index bd553f2..0945122 100644
--- a/dirsrvtests/tests/tickets/ticket49122_test.py
+++ b/dirsrvtests/tests/tickets/ticket49122_test.py
@@ -2,8 +2,7 @@ import time
import ldap
import logging
import pytest
-from lib389 import DirSrv, Entry, tools, tasks
-from lib389.tools import DirSrvTools
+from lib389 import Entry
from lib389._constants import *
from lib389.properties import *
from lib389.tasks import *
@@ -19,6 +18,15 @@ log = logging.getLogger(__name__)
USER_DN = 'uid=user,' + DEFAULT_SUFFIX
ROLE_DN = 'cn=Filtered_Role_That_Includes_Empty_Role,' + DEFAULT_SUFFIX
+filters = ['nsrole=cn=empty,dc=example,dc=com',
+ '(nsrole=cn=empty,dc=example,dc=com)',
+ '(&(nsrole=cn=empty,dc=example,dc=com))',
+ '(!(nsrole=cn=empty,dc=example,dc=com))',
+ '(&(|(objectclass=person)(sn=app*))(userpassword=*))',
+
'(&(|(objectclass=person)(nsrole=cn=empty,dc=example,dc=com))(userpassword=*))',
+
'(&(|(nsrole=cn=empty,dc=example,dc=com)(sn=app*))(userpassword=*))',
+
'(&(|(objectclass=person)(sn=app*))(nsrole=cn=empty,dc=example,dc=com))',
+
'(&(|(&(cn=*)(objectclass=person)(nsrole=cn=empty,dc=example,dc=com)))(uid=*))']
def test_ticket49122(topo):
@@ -29,18 +37,6 @@ def test_ticket49122(topo):
topo.standalone.plugins.enable(name=PLUGIN_ROLES)
topo.standalone.restart()
- # Add invalid role
- try:
- topo.standalone.add_s(Entry((
- ROLE_DN, {'objectclass': ['top', 'ldapsubentry',
'nsroledefinition',
- 'nscomplexroledefinition',
'nsfilteredroledefinition'],
- 'cn': 'Filtered_Role_That_Includes_Empty_Role',
- 'nsRoleFilter':
'(!(nsrole=cn=This_Is_An_Empty_Managed_NsRoleDefinition,dc=example,dc=com))',
- 'description': 'A filtered role with filter that will
crash the server'})))
- except ldap.LDAPError as e:
- topo.standalone.log.fatal('Failed to add filtered role: error ' +
e.message['desc'])
- assert False
-
# Add test user
try:
topo.standalone.add_s(Entry((
@@ -51,16 +47,39 @@ def test_ticket49122(topo):
assert False
if DEBUGGING:
- # Add debugging steps(if any)...
- print "Attach gdb"
+ print("Attach gdb")
time.sleep(20)
- # Search for the role
- try:
- topo.standalone.search_s(USER_DN, ldap.SCOPE_SUBTREE, 'objectclass=*',
['nsrole'])
- except ldap.LDAPError as e:
- topo.standalone.log.fatal('Search failed: error ' + str(e))
- assert False
+ # Loop over filters
+ for role_filter in filters:
+ log.info('Testing filter: ' + role_filter)
+
+ # Add invalid role
+ try:
+ topo.standalone.add_s(Entry((
+ ROLE_DN, {'objectclass': ['top', 'ldapsubentry',
'nsroledefinition',
+ 'nscomplexroledefinition',
'nsfilteredroledefinition'],
+ 'cn':
'Filtered_Role_That_Includes_Empty_Role',
+ 'nsRoleFilter': role_filter,
+ 'description': 'A filtered role with filter that
will crash the server'})))
+ except ldap.LDAPError as e:
+ topo.standalone.log.fatal('Failed to add filtered role: error ' +
e.message['desc'])
+ assert False
+
+ # Search for the role
+ try:
+ topo.standalone.search_s(USER_DN, ldap.SCOPE_SUBTREE,
'objectclass=*', ['nsrole'])
+ except ldap.LDAPError as e:
+ topo.standalone.log.fatal('Search failed: error ' + str(e))
+ assert False
+
+ # Cleanup
+ try:
+ topo.standalone.delete_s(ROLE_DN)
+ except ldap.LDAPError as e:
+ topo.standalone.log.fatal('delete failed: error ' + str(e))
+ assert False
+ time.sleep(1)
topo.standalone.log.info('Test Passed')
diff --git a/ldap/servers/plugins/roles/roles_cache.c
b/ldap/servers/plugins/roles/roles_cache.c
index 66c8553..161b957 100644
--- a/ldap/servers/plugins/roles/roles_cache.c
+++ b/ldap/servers/plugins/roles/roles_cache.c
@@ -1074,20 +1074,38 @@ static int roles_cache_create_role_under(roles_cache_def**
roles_cache_suffix, S
}
/*
- * Check that we are not using nsrole in the filter
+ * Check that we are not using nsrole in the filter, recurse over all the
+ * nested filters.
*/
static int roles_check_filter(Slapi_Filter *filter_list)
{
Slapi_Filter *f;
char *type = NULL;
- for ( f = slapi_filter_list_first( filter_list );
- f != NULL;
- f = slapi_filter_list_next( filter_list, f ) )
- {
- slapi_filter_get_attribute_type(f, &type);
- if (strcasecmp(type, NSROLEATTR) == 0){
- return -1;
+ f = slapi_filter_list_first( filter_list );
+ if (f == NULL){
+ /* Single filter */
+ if (slapi_filter_get_attribute_type(filter_list, &type) == 0){
+ if (strcasecmp(type, NSROLEATTR) == 0){
+ return -1;
+ }
+ }
+ }
+ for ( ; f != NULL; f = slapi_filter_list_next(filter_list, f) ){
+ /* Complex filter */
+ if (slapi_filter_list_first(f)) {
+ /* Another filter list - recurse */
+ if (roles_check_filter(f) == -1){
+ /* Done, break out */
+ return -1;
+ }
+ } else {
+ /* Not a filter list, so check the type */
+ if (slapi_filter_get_attribute_type(f, &type) == 0){
+ if (strcasecmp(type, NSROLEATTR) == 0){
+ return -1;
+ }
+ }
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.