From 9f1d12e3de174964b02e6507494fe3de1aca1766 Mon Sep 17 00:00:00 2001

From: Mark Reynolds <mreynolds@redhat.com>

Date: Mon, 20 Mar 2017 15:08:45 -0400

Subject: [PATCH] Issue 49095 - targetattr wildcard evaluation is incorrectly

 case sensitive

Description:  When processing an aci that uses a wildcard targetattr, the

              comparision should be done using case insensitive functions.

https://pagure.io/389-ds-base/issue/49095

Reviewed by: firstyear(Thanks!)

(cherry picked from commit fdf78dca6c34b32522443c82ddd4c3c7ef04da80)

---

 dirsrvtests/tests/tickets/ticket49095_test.py | 85 +++++++++++++++++++++++++++

 ldap/servers/plugins/acl/acl.c                | 10 ++--

 2 files changed, 90 insertions(+), 5 deletions(-)

 create mode 100644 dirsrvtests/tests/tickets/ticket49095_test.py

diff --git a/dirsrvtests/tests/tickets/ticket49095_test.py b/dirsrvtests/tests/tickets/ticket49095_test.py

new file mode 100644

index 0000000..04f92b2

--- /dev/null

+++ b/dirsrvtests/tests/tickets/ticket49095_test.py

@@ -0,0 +1,85 @@

+import time

+import ldap

+import logging

+import pytest

+from lib389 import DirSrv, Entry, tools, tasks

+from lib389.tools import DirSrvTools

+from lib389._constants import *

+from lib389.properties import *

+from lib389.tasks import *

+from lib389.utils import *

+from lib389.topologies import topology_st as topo

+

+DEBUGGING = os.getenv("DEBUGGING", default=False)

+if DEBUGGING:

+    logging.getLogger(__name__).setLevel(logging.DEBUG)

+else:

+    logging.getLogger(__name__).setLevel(logging.INFO)

+log = logging.getLogger(__name__)

+

+USER_DN = 'uid=testuser,dc=example,dc=com'

+acis = ['(targetattr != "tele*") (version 3.0;acl "test case";allow (read,compare,search)(userdn = "ldap:///anyone");)',

+        '(targetattr != "TELE*") (version 3.0;acl "test case";allow (read,compare,search)(userdn = "ldap:///anyone");)',

+        '(targetattr != "telephonenum*") (version 3.0;acl "test case";allow (read,compare,search)(userdn = "ldap:///anyone");)',

+        '(targetattr != "TELEPHONENUM*") (version 3.0;acl "test case";allow (read,compare,search)(userdn = "ldap:///anyone");)']

+

+

+def test_ticket49095(topo):

+    """Check that target attrbiutes with wildcards are case insensitive

+    """

+

+    # Add an entry

+    try:

+        topo.standalone.add_s(Entry((USER_DN, {

+            'objectclass': 'top extensibleObject'.split(),

+            'uid': 'testuser',

+            'telephonenumber': '555-555-5555'

+        })))

+    except ldap.LDAPError as e:

+            log.fatal('Failed to add test user: ' + e.message['desc'])

+            assert False

+

+    for aci in acis:

+        # Add ACI

+        try:

+            topo.standalone.modify_s(DEFAULT_SUFFIX,

+                          [(ldap.MOD_REPLACE, 'aci', aci)])

+

+        except ldap.LDAPError as e:

+            log.fatal('Failed to set aci: ' + aci + ': ' + e.message['desc'])

+            assert False

+

+        # Set Anonymous Bind to test aci

+        try:

+            topo.standalone.simple_bind_s("", "")

+        except ldap.LDAPError as e:

+            log.fatal('Failed to bind anonymously: ' + e.message['desc'])

+            assert False

+

+        # Search for entry - should not get any results

+        try:

+            entry = topo.standalone.search_s(DEFAULT_SUFFIX, ldap.SCOPE_BASE,

+                                             'telephonenumber=*')

+            if entry:

+                log.fatal('The entry was incorrectly returned')

+                assert False

+        except ldap.LDAPError as e:

+            log.fatal('Failed to search anonymously: ' + e.message['desc'])

+            assert False

+

+        # Set root DN Bind so we can update aci's

+        try:

+            topo.standalone.simple_bind_s(DN_DM, PASSWORD)

+        except ldap.LDAPError as e:

+            log.fatal('Failed to bind anonymously: ' + e.message['desc'])

+            assert False

+

+    log.info("Test Passed")

+

+

+if __name__ == '__main__':

+    # Run isolated

+    # -s for DEBUG mode

+    CURRENT_FILE = os.path.realpath(__file__)

+    pytest.main("-s %s" % CURRENT_FILE)

+

diff --git a/ldap/servers/plugins/acl/acl.c b/ldap/servers/plugins/acl/acl.c

index ba6b774..1caa88a 100644

--- a/ldap/servers/plugins/acl/acl.c

+++ b/ldap/servers/plugins/acl/acl.c

@@ -3407,19 +3407,19 @@ acl_match_substring ( Slapi_Filter *f, char *str, int exact_match)

 	}

 	/* this assumes that str and the filter components are already

-	 * normalized. If not, it shoul be done

+	 * normalized. If not, it should be done

 	 */

 	if ( initial != NULL) {

 		len = strlen(initial);

 		if (exact_match) {

-			int rc = strncmp(p, initial, len);

+			int rc = strncasecmp(p, initial, len);

 			if (rc) {

 				return ACL_FALSE;

 			} else {

 				p += len;

 			}  

 		} else {

-			p = strstr(p, initial);

+			p = strcasestr(p, initial);

 			if (p) {

 				p += len;

 			} else {

@@ -3430,7 +3430,7 @@ acl_match_substring ( Slapi_Filter *f, char *str, int exact_match)

 	if ( any != NULL) {

 		for (i = 0;  any && any[i] != NULL; i++) {

-			p = strstr(p, any[i]);

+			p = strcasestr(p, any[i]);

 			if (p) {

 				p += strlen(any[i]);

 			} else {

@@ -3444,7 +3444,7 @@ acl_match_substring ( Slapi_Filter *f, char *str, int exact_match)

 		len = strlen(final);

 		tlen = strlen(p);

 		if (len > tlen) return ACL_FALSE;

-		if (strcmp(p+tlen-len, final)) return ACL_FALSE;

+		if (strcasecmp(p+tlen-len, final)) return ACL_FALSE;

 	}

 	return ACL_TRUE;

-- 

2.9.3