Commit 5f6043c0 authored by Kurt Zeilenga's avatar Kurt Zeilenga
Browse files

Fixed slapd attrs/objectclass replog issues (ITS#4298)

Fixed slapd-ldap password modify exop password return (ITS#4294)
parent e2ed30f7
......@@ -2,8 +2,10 @@ OpenLDAP 2.3 Change Log
OpenLDAP 2.3.15 Engineering
Fixed slapd strerror logging bug (ITS#4292)
Fixed slapd-ldap password modify exop password return (ITS#4294)
Fixed slapd ACL add/delete fraction issue (ITS#4295)
Fixed slapd ACL users selfwrite issue (ITS#4299)
Fixed slapd attrs/objectclass replog issues (ITS#4298)
Fixed slapd-ldap password modify exop password return (ITS#4294)
Build environment
Disable test030-relay when threads are unavailable (ITS#4297)
......
......@@ -951,6 +951,8 @@ static int
acl_mask_dn(
Operation *op,
Entry *e,
AttributeDescription *desc,
struct berval *val,
AccessControl *a,
int nmatch,
regmatch_t *matches,
......@@ -978,6 +980,27 @@ acl_mask_dn(
return 1;
}
if ( b->a_self ) {
const char *dummy;
int rc, match = 0;
/* must have DN syntax */
if ( desc->ad_type->sat_syntax != slap_schema.si_syn_distinguishedName ) return 1;
/* check if the target is an attribute. */
if ( val == NULL ) return 1;
/* target is attribute, check if the attribute value
* is the op dn.
*/
rc = value_match( &match, desc,
desc->ad_type->sat_equality, 0,
val, opndn, &dummy );
/* on match error or no match, fail the ACL clause */
if ( rc != LDAP_SUCCESS || match != 0 )
return 1;
}
} else if ( b->a_style == ACL_STYLE_SELF ) {
struct berval ndn, selfndn;
int level;
......@@ -1411,7 +1434,7 @@ slap_acl_mask(
* is maintaned in a_dn_pat.
*/
if ( acl_mask_dn( op, e, a, nmatch, matches,
if ( acl_mask_dn( op, e, desc, val, a, nmatch, matches,
&b->a_dn, &op->o_ndn ) )
{
continue;
......@@ -1442,7 +1465,7 @@ slap_acl_mask(
ndn = op->o_ndn;
}
if ( acl_mask_dn( op, e, a, nmatch, matches,
if ( acl_mask_dn( op, e, desc, val, a, nmatch, matches,
&b->a_realdn, &ndn ) )
{
continue;
......
......@@ -328,11 +328,22 @@ replog1(
if ( ri && ri->ri_attrs ) {
int is_in = ad_inlist( ml->sml_desc, ri->ri_attrs );
/* skip if:
* 1) the attribute is not in the list,
* and it's not an exclusion list
* 2) the attribute is in the list
* and it's an exclusion list,
* and either the objectClass attribute
* has already been dealt with or
* this is not the objectClass attr
*/
if ( ( !is_in && !ri->ri_exclude )
|| ( is_in && ri->ri_exclude ) )
|| ( ( is_in && ri->ri_exclude )
&& ( !ocs || a->a_desc != slap_schema.si_ad_objectClass ) ) )
{
continue;
}
/* If this is objectClass, see if the value is included
* in any subset, otherwise drop it.
*/
......@@ -347,11 +358,24 @@ replog1(
int match = 0;
for ( an = ri->ri_attrs; an->an_name.bv_val; an++ ) {
if ( an->an_oc ) {
struct berval bv = an->an_name;
ocs = 1;
match |= an->an_oc_exclude;
if ( ml->sml_values[i].bv_len == an->an_name.bv_len
switch ( bv.bv_val[ 0 ] ) {
case '@':
case '+':
case '!':
bv.bv_val++;
bv.bv_len--;
break;
}
if ( ml->sml_values[i].bv_len == bv.bv_len
&& !strcasecmp(ml->sml_values[i].bv_val,
an->an_name.bv_val ) ) {
bv.bv_val ) )
{
match = !an->an_oc_exclude;
break;
}
......@@ -374,7 +398,7 @@ replog1(
fprintf( fp, "%s: %s\n", did, type );
first = 0;
}
vals[0] = an->an_name;
vals[0] = a->a_nvals[i];
print_vals( fp, &ml->sml_desc->ad_cname, vals );
ocs = 2;
}
......@@ -406,7 +430,20 @@ replog1(
for ( a = op->ora_e->e_attrs ; a != NULL; a=a->a_next ) {
if ( ri && ri->ri_attrs ) {
int is_in = ad_inlist( a->a_desc, ri->ri_attrs );
if ( ( !is_in && !ri->ri_exclude ) || ( is_in && ri->ri_exclude ) ) {
/* skip if:
* 1) the attribute is not in the list,
* and it's not an exclusion list
* 2) the attribute is in the list
* and it's an exclusion list,
* and either the objectClass attribute
* has already been dealt with or
* this is not the objectClass attr
*/
if ( ( !is_in && !ri->ri_exclude )
|| ( ( is_in && ri->ri_exclude )
&& ( !ocs || a->a_desc != slap_schema.si_ad_objectClass ) ) )
{
continue;
}
......@@ -423,11 +460,24 @@ replog1(
int match = 0;
for ( an = ri->ri_attrs; an->an_name.bv_val; an++ ) {
if ( an->an_oc ) {
struct berval bv = an->an_name;
ocs = 1;
match |= an->an_oc_exclude;
if ( a->a_vals[i].bv_len == an->an_name.bv_len
switch ( bv.bv_val[ 0 ] ) {
case '@':
case '+':
case '!':
bv.bv_val++;
bv.bv_len--;
break;
}
if ( a->a_vals[i].bv_len == bv.bv_len
&& !strcasecmp(a->a_vals[i].bv_val,
an->an_name.bv_val ) ) {
bv.bv_val ) )
{
match = !an->an_oc_exclude;
break;
}
......@@ -442,7 +492,7 @@ replog1(
fprintf( fp, "changetype: add\n" );
dohdr = 0;
}
vals[0] = an->an_name;
vals[0] = a->a_nvals[i];
print_vals( fp, &a->a_desc->ad_cname, vals );
}
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment