From c629c7ffe35bb2a09ad4dfa60d56fb01a51915d0 Mon Sep 17 00:00:00 2001 From: Mark Reynolds Date: Fri, 2 Aug 2019 14:36:24 -0400 Subject: [PATCH] Issue 50530 - Directory Server not RFC 4511 compliant with requested attr "1.1" Bug Description: A regression was introduced some time back that changed the behavior of how the server handled the "1.1" requested attribute in a search request. If "1.1" was requested along with other attributes then no attibutes were returned, but in this case "1.1" is expected to be ignroed. Fix Description: Only comply with "1.1" if it is the only requested attribute relates: https://pagure.io/389-ds-base/issue/50530 Reviewed by: firstyear(Thanks!) --- dirsrvtests/tests/suites/basic/basic_test.py | 57 +++++++++++++++++--- ldap/servers/slapd/result.c | 7 ++- 2 files changed, 57 insertions(+), 7 deletions(-) diff --git a/dirsrvtests/tests/suites/basic/basic_test.py b/dirsrvtests/tests/suites/basic/basic_test.py index 0f7536b63..cea4f6bfe 100644 --- a/dirsrvtests/tests/suites/basic/basic_test.py +++ b/dirsrvtests/tests/suites/basic/basic_test.py @@ -28,6 +28,7 @@ log = logging.getLogger(__name__) USER1_DN = 'uid=user1,' + DEFAULT_SUFFIX USER2_DN = 'uid=user2,' + DEFAULT_SUFFIX USER3_DN = 'uid=user3,' + DEFAULT_SUFFIX +USER4_DN = 'uid=user4,' + DEFAULT_SUFFIX ROOTDSE_DEF_ATTR_LIST = ('namingContexts', 'supportedLDAPVersion', @@ -409,8 +410,8 @@ def test_basic_acl(topology_st, import_example_ldif): 'uid': 'user1', 'userpassword': PASSWORD}))) except ldap.LDAPError as e: - log.fatal('test_basic_acl: Failed to add test user ' + USER1_DN - + ': error ' + e.message['desc']) + log.fatal('test_basic_acl: Failed to add test user ' + USER1_DN + + ': error ' + e.message['desc']) assert False try: @@ -421,8 +422,8 @@ def test_basic_acl(topology_st, import_example_ldif): 'uid': 'user2', 'userpassword': PASSWORD}))) except ldap.LDAPError as e: - log.fatal('test_basic_acl: Failed to add test user ' + USER1_DN - + ': error ' + e.message['desc']) + log.fatal('test_basic_acl: Failed to add test user ' + USER1_DN + + ': error ' + e.message['desc']) assert False # @@ -572,6 +573,50 @@ def test_basic_searches(topology_st, import_example_ldif): log.info('test_basic_searches: PASSED') +@pytest.fixture(scope="module") +def add_test_entry(topology_st, request): + # Add test entry + topology_st.standalone.add_s(Entry((USER4_DN, + {'objectclass': "top extensibleObject".split(), + 'cn': 'user1', 'uid': 'user1'}))) + + +search_params = [(['1.1'], 'cn', False), + (['1.1', 'cn'], 'cn', True), + (['+'], 'nsUniqueId', True), + (['*'], 'cn', True), + (['cn'], 'cn', True)] +@pytest.mark.parametrize("attrs, attr, present", search_params) +def test_search_req_attrs(topology_st, add_test_entry, attrs, attr, present): + """Test requested attributes in search operations. + :id: 426a59ff-49b8-4a70-b377-0c0634a29b6e + :setup: Standalone instance + :steps: + 1. Test "1.1" does not return any attributes. + 2. Test "1.1" is ignored if there are other requested attributes + 3. Test "+" returns all operational attributes + 4. Test "*" returns all attributes + 5. Test requested attributes + + :expectedresults: + 1. Success + 2. Success + 3. Success + 4. Success + 5. Success + """ + + log.info("Testing attrs: {} attr: {} present: {}".format(attrs, attr, present)) + entry = topology_st.standalone.search_s(USER4_DN, + ldap.SCOPE_BASE, + 'objectclass=top', + attrs) + if present: + assert entry[0].hasAttr(attr) + else: + assert not entry[0].hasAttr(attr) + + def test_basic_referrals(topology_st, import_example_ldif): """Test LDAP server in referral mode. @@ -716,8 +761,8 @@ def test_basic_systemctl(topology_st, import_example_ldif): log.info('Attempting to start the server with broken dse.ldif...') try: topology_st.standalone.start() - except: - log.info('Server failed to start as expected') + except Exception as e: + log.info('Server failed to start as expected: ' + str(e)) log.info('Check the status...') assert (not topology_st.standalone.status()) log.info('Server failed to start as expected') diff --git a/ldap/servers/slapd/result.c b/ldap/servers/slapd/result.c index 393b3f6cd..61e7a70f9 100644 --- a/ldap/servers/slapd/result.c +++ b/ldap/servers/slapd/result.c @@ -1546,6 +1546,8 @@ send_ldap_search_entry_ext( * "+" means all operational attributes (rfc3673) * operational attributes are only retrieved if they are named * specifically or when "+" is specified. + * In the case of "1.1", if there are other requested attributes + * then "1.1" should be ignored. */ /* figure out if we want all user attributes or no attributes at all */ @@ -1560,7 +1562,10 @@ send_ldap_search_entry_ext( if (strcmp(LDAP_ALL_USER_ATTRS, attrs[i]) == 0) { alluserattrs = 1; } else if (strcmp(LDAP_NO_ATTRS, attrs[i]) == 0) { - noattrs = 1; + /* "1.1" is only valid if it's the only requested attribute */ + if (i == 0 && attrs[1] == NULL) { + noattrs = 1; + } } else if (strcmp(LDAP_ALL_OPERATIONAL_ATTRS, attrs[i]) == 0) { alloperationalattrs = 1; } else { -- 2.21.1