From 76d8b45b71563d6158464f7a34bcb57d470993dc Mon Sep 17 00:00:00 2001
From: Viktor Ashirov <vashirov@redhat.com>
Date: Fri, 21 Jun 2019 16:41:34 +0200
Subject: [PATCH 03/12] Issue 50378 - ACI's with IPv4 and IPv6 bind rules do
 not work for IPv6 clients

Description:

Add a new test case for #50378 instead of the older one that was testing
an unsupported corner case (ip=*).

Relates: https://pagure.io/389-ds-base/issue/50378

Reviewed by: mreynolds (Thanks!)
---
 dirsrvtests/tests/suites/acl/keywords_test.py | 29 ++++++++++---------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/dirsrvtests/tests/suites/acl/keywords_test.py b/dirsrvtests/tests/suites/acl/keywords_test.py
index c8c19127b..6a494a4b6 100644
--- a/dirsrvtests/tests/suites/acl/keywords_test.py
+++ b/dirsrvtests/tests/suites/acl/keywords_test.py
@@ -430,30 +430,33 @@ def test_dnsalias_keyword_test_nodns_cannot(topo, add_user, aci_of_user):
     with pytest.raises(ldap.INSUFFICIENT_ACCESS):
         org.replace("seeAlso", "cn=1")
 
-
-def test_user_can_access_the_data_when_connecting_from_any_machine_2(topo, add_user, aci_of_user):
+@pytest.mark.ds50378
+@pytest.mark.bz1710848
+@pytest.mark.parametrize("ip_addr", ['127.0.0.1', "[::1]"])
+def test_user_can_access_from_ipv4_or_ipv6_address(topo, add_user, aci_of_user, ip_addr):
     """
-    User can access the data when connecting from any machine as per the ACI.
+    User can modify the data when accessing the server from the allowed IPv4 and IPv6 addresses
 
     :id:461e761e-7ac5-11e8-9ae4-8c16451d917b
     :setup: Standalone Server
     :steps:
-        1. Add test entry
-        2. Add ACI
-        3. User should follow ACI role
+        1. Add ACI that has both IPv4 and IPv6
+        2. Connect from one of the IPs allowed in ACI
+        3. Modify an attribute
     :expectedresults:
-        1. Entry should be added
-        2. Operation should  succeed
-        3. Operation should  succeed
+        1. ACI should be added
+        2. Conection should be successful
+        3. Operation should be successful
     """
-    # Add ACI
+    # Add ACI that contains both IPv4 and IPv6
     Domain(topo.standalone, DEFAULT_SUFFIX).\
-        add("aci", f'(target ="ldap:///{IP_OU_KEY}")(targetattr=*)'
+        add("aci", f'(target ="ldap:///{IP_OU_KEY}")(targetattr=*) '
                    f'(version 3.0; aci "IP aci"; allow(all) '
-                   f'userdn = "ldap:///{FULLIP_KEY}" and ip = "*" ;)')
+                   f'userdn = "ldap:///{FULLIP_KEY}" and (ip = "127.0.0.1" or ip = "::1");)')
 
     # Create a new connection for this test.
-    conn = UserAccount(topo.standalone, FULLIP_KEY).bind(PW_DM)
+    conn = UserAccount(topo.standalone, FULLIP_KEY).bind(PW_DM, uri=f'ldap://{ip_addr}:{topo.standalone.port}')
+
     # Perform Operation
     OrganizationalUnit(conn, IP_OU_KEY).replace("seeAlso", "cn=1")
 
-- 
2.21.0