From 8f756e72a6ad9f4b348b5247cc904bc8ed9dd839 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Aug 19 2022 14:31:34 +0000 Subject: [PATCH 1/2] schema-compat: fix ID view lookups When ID view is detected, it needs to be preserved until the end of search processing. We iterate over groups and need to know about ID views when collecting the matched entries. When ID view is detected, we restart map search from the top level (cn=compat,$SUFFIX). For the case of top level (cn=compat,$SUFFIX) match, a subtree which activated ID view usage was not actually going into individual groups to match overridden filter against the entries in those groups. This was due to premature comparison with the group DN as backend_should_descend() would have always matched it and caused to short-circuit processing with empty entries. Finally, since all memory allocations during the search must be present until the search is processed, do not short-circuit 'return 0' from within. Use a general cleanup code instead. Resolves: rhbz#1984010 Signed-off-by: Alexander Bokovoy --- diff --git a/src/back-sch-idview.c b/src/back-sch-idview.c index a0e0ac7..de34f2f 100644 --- a/src/back-sch-idview.c +++ b/src/back-sch-idview.c @@ -77,7 +77,6 @@ idview_get_overrides(struct backend_search_cbdata *cbdata) "(objectclass=ipaOverrideAnchor)", NULL, 0, NULL, NULL, cbdata->state->plugin_identity, 0); slapi_search_internal_pb(pb); - slapi_ch_free_string(&dn); slapi_pblock_get(pb, SLAPI_PLUGIN_INTOP_RESULT, &result); if (result == 0) { @@ -86,6 +85,7 @@ idview_get_overrides(struct backend_search_cbdata *cbdata) slapi_pblock_set(pb, SLAPI_PLUGIN_INTOP_SEARCH_ENTRIES, NULL); } + slapi_ch_free_string(&dn); wrap_dec_call_level(); slapi_pblock_destroy(pb); } @@ -426,5 +426,4 @@ idview_replace_filter(struct backend_search_cbdata *cbdata) if (config.name != NULL) { slapi_ch_free_string(&config.name); } - } diff --git a/src/back-sch.c b/src/back-sch.c index b2c020f..68af863 100644 --- a/src/back-sch.c +++ b/src/back-sch.c @@ -1366,13 +1366,18 @@ backend_search_find_set_dn_cb(const char *group, void *cb_data) if (backend_should_descend(group_dn, cbdata->target_dn, cbdata->scope)) { - cbdata->answer = TRUE; + map_data_foreach_map(cbdata->state, group, + backend_search_find_set_dn_in_group_cb, cb_data); + if (cbdata->answer != TRUE) { + if (slapi_sdn_compare(group_dn, + cbdata->target_dn) == 0) { + cbdata->answer = TRUE; + } + } slapi_sdn_free(&group_dn); return TRUE; } - map_data_foreach_map(cbdata->state, group, - backend_search_find_set_dn_in_group_cb, cb_data); slapi_sdn_free(&group_dn); return TRUE; } @@ -1753,43 +1758,20 @@ backend_search_cb(Slapi_PBlock *pb) /* We may have multiple disjoint trees in the sets, search if the target matches any of them * as in general there don't have to be a single subtree (cn=compat,$SUFFIX) for all trees to easily * detect the ID view use. Unless the ID view is within the set we control, don't consider the override */ + target = slapi_ch_strdup(original_target); + idview_replace_target_dn(&target, &cbdata.idview); + if (cbdata.idview != NULL) { + slapi_sdn_free(&cbdata.target_dn); + /* Perform another check, now for rewritten DN */ + cbdata.target_dn = slapi_sdn_new_dn_byval(target); + } map_data_foreach_domain(cbdata.state, backend_search_find_set_dn_cb, &cbdata); if (cbdata.answer == FALSE) { - target = slapi_ch_strdup(original_target); - idview_replace_target_dn(&target, &cbdata.idview); - if (cbdata.idview != NULL) { - slapi_sdn_free(&cbdata.target_dn); - /* Perform another check, now for rewritten DN */ - cbdata.target_dn = slapi_sdn_new_dn_byval(target); - map_data_foreach_domain(cbdata.state, backend_search_find_set_dn_cb, &cbdata); - - /* Rewritten DN might still be outside of our trees */ - if (cbdata.answer == TRUE) { - slapi_log_error(SLAPI_LOG_PLUGIN, cbdata.state->plugin_desc->spd_id, - "Use of ID view '%s' is detected, searching from \"%s\" " - "for \"%s\" with scope %d%s. Filter may get overridden later.\n", - cbdata.idview, target, cbdata.strfilter, cbdata.scope, - backend_sch_scope_as_string(cbdata.scope)); - } - - slapi_sdn_free(&cbdata.target_dn); - slapi_ch_free_string(&cbdata.idview); - - if (cbdata.answer == FALSE) { - slapi_log_error(SLAPI_LOG_PLUGIN, - cbdata.state->plugin_desc->spd_id, - "The search base didn't match any of the containers, " - "ignoring search\n"); - slapi_ch_free_string(&target); - return 0; - } - } - slapi_ch_free_string(&target); - if (cbdata.answer == FALSE) { - /* None of the configured trees in the sets matched the target at all, ignore search */ - slapi_sdn_free(&cbdata.target_dn); - return 0; - } + slapi_log_error(SLAPI_LOG_PLUGIN, + cbdata.state->plugin_desc->spd_id, + "The search base %s didn't match any of the containers, " + "ignoring search\n", target); + goto cleanup; } cbdata.answer = FALSE; #endif @@ -1939,10 +1921,9 @@ backend_search_cb(Slapi_PBlock *pb) cbdata.closest_match, cbdata.text, cbdata.n_entries, NULL); } +cleanup: slapi_sdn_free(&cbdata.target_dn); - if (cbdata.idview != NULL) { - slapi_ch_free_string(&target); - } + slapi_ch_free_string(&target); slapi_ch_free_string(&cbdata.idview); #ifdef USE_IPA_IDVIEWS idview_free_overrides(&cbdata); From b199598ca48a8cf7fe25dcc01ef561b2e9e6eb28 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Aug 19 2022 14:31:34 +0000 Subject: [PATCH 2/2] Fix debug message typo: dot after line return Signed-off-by: Alexander Bokovoy --- diff --git a/src/back-sch-idview.c b/src/back-sch-idview.c index de34f2f..6f870a9 100644 --- a/src/back-sch-idview.c +++ b/src/back-sch-idview.c @@ -314,7 +314,7 @@ idview_replace_bval_by_override(const char *bval_usage, const char *attr_name, attr_val = slapi_value_new_berval(bval); slapi_log_error(SLAPI_LOG_PLUGIN, cbdata->state->plugin_desc->spd_id, - "Searching for an override of the %s %s with %s=%*s from the overrides\n.", + "Searching for an override of the %s %s with %s=%*s from the overrides.\n", bval_usage, attr_name, attr_name, (int) bval->bv_len, bval->bv_val); /* If filter contains an attribute name which is overridden in the view and filter value