From 59b2189ecb246ee24f4a693fbb8a2bde8d8bc41d Mon Sep 17 00:00:00 2001 From: Ludwig Krispenz Date: Thu, 29 Mar 2018 15:03:12 +0200 Subject: [PATCH] Ticket - 49617 - SRCH results differ from one_level to subtree The search filter is extended to handle scope, eg adding a component "parentid=idofsearchbase". This filter is now preserverd in the pblock and used for filter evaluation, including evaluation of access rights. But the parentid component is only used for scoping and has to treated as internal and allowed to any client. To resolve this a new filter flag is introduced which will be set in the generated scope filter and later used to bypass access control for this filter component. This does not mean taht access to parentid is general granted, a client search for "parentid=nnn" will still fail if it has no access right to teh parentid attribute. Reviewed by: ? --- ldap/servers/slapd/back-ldbm/ldbm_search.c | 4 ++++ ldap/servers/slapd/filterentry.c | 5 +++++ ldap/servers/slapd/slapi-private.h | 1 + 3 files changed, 10 insertions(+) diff --git a/ldap/servers/slapd/back-ldbm/ldbm_search.c b/ldap/servers/slapd/back-ldbm/ldbm_search.c index c39599d..9fe90be 100644 --- a/ldap/servers/slapd/back-ldbm/ldbm_search.c +++ b/ldap/servers/slapd/back-ldbm/ldbm_search.c @@ -1058,6 +1058,10 @@ create_onelevel_filter(Slapi_Filter *filter, const struct backentry *baseEntry, Slapi_Filter *fid2kids = slapi_str2filter(buf); Slapi_Filter *fand = slapi_filter_join(LDAP_FILTER_AND, ftop, fid2kids); + /* this filter will be used in scope test and has to be granted + * but only to this filter, not the joined one */ + fid2kids->f_flags |= SLAPI_FILTER_ACCESS_GRANTED; + return fand; } diff --git a/ldap/servers/slapd/filterentry.c b/ldap/servers/slapd/filterentry.c index 82eb196..b7d5ae5 100644 --- a/ldap/servers/slapd/filterentry.c +++ b/ldap/servers/slapd/filterentry.c @@ -797,6 +797,11 @@ slapi_vattr_filter_test_ext_internal( slapi_log_err(SLAPI_LOG_FILTER, "slapi_vattr_filter_test_ext_internal", "<=\n"); + if (f->f_flags & SLAPI_FILTER_ACCESS_GRANTED) { + verify_access = 0; + *access_check_done = 1; + } + switch (f->f_choice) { case LDAP_FILTER_EQUALITY: slapi_log_err(SLAPI_LOG_FILTER, "slapi_vattr_filter_test_ext_internal", "EQUALITY\n"); diff --git a/ldap/servers/slapd/slapi-private.h b/ldap/servers/slapd/slapi-private.h index c28c6e7..1cbfe04 100644 --- a/ldap/servers/slapd/slapi-private.h +++ b/ldap/servers/slapd/slapi-private.h @@ -54,6 +54,7 @@ extern "C" { #define SLAPI_ENTRY_LDAPSUBENTRY 2 #define SLAPI_FILTER_NORMALIZED_TYPE 8 #define SLAPI_FILTER_NORMALIZED_VALUE 16 +#define SLAPI_FILTER_ACCESS_GRANTED 32 /* Optimized filter path. For example the following code was lifted from int.c (syntaxes plugin): -- 2.9.5