From 29d38010ad6abd11ba663ff98836be933fa66850 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Mon, 24 Apr 2023 16:22:11 +0300 Subject: [PATCH] Handle base searches within the compat tree Related: rhbz#2183469 Signed-off-by: Alexander Bokovoy --- slapi-nis-bz2183469.patch | 36 ++++++++++++++++++++++++++++++++++-- slapi-nis.spec | 8 ++++++-- 2 files changed, 40 insertions(+), 4 deletions(-) diff --git a/slapi-nis-bz2183469.patch b/slapi-nis-bz2183469.patch index 5b0c9b3..7f8db7f 100644 --- a/slapi-nis-bz2183469.patch +++ b/slapi-nis-bz2183469.patch @@ -1,7 +1,7 @@ From 24eeccd408d9627299231d7843ca9e65e71af3de Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 21 Mar 2023 17:32:47 +0200 -Subject: [PATCH] Test the case when container is a child of the target DN +Subject: [PATCH 1/2] Test the case when container is a child of the target DN We can have target DN both inside or outside of a container. Previously, the code did not look into the latter one. When container is @@ -42,5 +42,37 @@ index 93746b1..e447bda 100644 } -- -2.39.2 +2.40.0 + + +From 73058645eac86b40913deec01807854e0a8bda0d Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Mon, 24 Apr 2023 12:19:10 +0300 +Subject: [PATCH 2/2] Identify the container without search base check + +Ignore the actual search base when identifying whether a target DN is +within a known data container. The reason is that we need to know +whether a search would have to descent into a particular container. The +scope validation will happen later. + +Signed-off-by: Alexander Bokovoy +--- + src/back-sch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/back-sch.c b/src/back-sch.c +index e447bda..a79f61b 100644 +--- a/src/back-sch.c ++++ b/src/back-sch.c +@@ -1340,7 +1340,7 @@ backend_search_find_set_dn_in_group_cb(const char *group, const char *set, bool_ + + if (slapi_sdn_scope_test(cbdata->target_dn, + set_data->container_sdn, +- cbdata->scope) != 0) { ++ LDAP_SCOPE_SUBTREE) != 0) { + cbdata->answer = TRUE; + } else if ((cbdata->scope == LDAP_SCOPE_SUBTREE) && + slapi_sdn_scope_test(set_data->container_sdn, +-- +2.40.0 diff --git a/slapi-nis.spec b/slapi-nis.spec index 8310f8f..f441db3 100644 --- a/slapi-nis.spec +++ b/slapi-nis.spec @@ -11,7 +11,7 @@ Name: slapi-nis Version: 0.60.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: NIS Server and Schema Compatibility plugins for Directory Server Group: System Environment/Daemons License: GPLv3 @@ -87,7 +87,11 @@ make check %{_sbindir}/nisserver-plugin-defs %changelog -* Wed Apr 13 2023 Alexander Bokovoy - 0.60.0-2 +* Mon Apr 24 2023 Alexander Bokovoy - 0.60.0-3 +- Also handle base searches within the compat tree +- Related: rhbz#2183469 + +* Wed Apr 12 2023 Alexander Bokovoy - 0.60.0-2 - Fix base DN searches outside the compat tree - Resolves: rhbz#2183469