From 5e338e97715fbbb78cf6991583a8b78276263b02 Mon Sep 17 00:00:00 2001
From: Mark Reynolds <mreynolds@redhat.com>
Date: Oct 30 2019 13:00:52 +0000
Subject: Issue 50677 - Map subtree searches with NULL base to default naming context


Description:

The Root DSE entry is retreived by using a empty/NULL search base, and a
search scope of "BASE".  According to the RFCs these are the exact requirements
for returning the Root DSE, but it does not dictate what you must do if
a different search scope is used.  In DS we will return NO_SUCH_OBJECT if
the scope is ONE or SUBTREE.  In AD it will use the default suffix in this
case.

To be more compatible AD, specifically global catalog, 389 should also return
the default naming context for a non-Root DSE search(a NULL suffix with a
scope of ONE, or SUBTREE).

relates: https://pagure.io/389-ds-base/issue/50677

Reviewed by: firstyear(Thanks!)

---

diff --git a/ldap/servers/slapd/search.c b/ldap/servers/slapd/search.c
index 013bece..6cdb276 100644
--- a/ldap/servers/slapd/search.c
+++ b/ldap/servers/slapd/search.c
@@ -90,7 +90,7 @@ do_search(Slapi_PBlock *pb)
 
     /* baseObject, scope, derefAliases, sizelimit, timelimit, attrsOnly */
     if (ber_scanf(ber, "{aiiiib", &rawbase, &scope, &deref, &sizelimit, &timelimit, &attrsonly) == LBER_ERROR) {
-        slapi_ch_free((void **)&rawbase);
+        slapi_ch_free_string(&rawbase);
         log_search_access(pb, "???", -1, "???", "decoding error");
         send_ldap_result(pb, LDAP_PROTOCOL_ERROR, NULL, NULL, 0, NULL);
         return;
@@ -106,11 +106,20 @@ do_search(Slapi_PBlock *pb)
                                        rawbase ? rawbase : "", "strict: invalid dn");
             send_ldap_result(pb, LDAP_INVALID_DN_SYNTAX,
                              NULL, "invalid dn", 0, NULL);
-            slapi_ch_free((void **)&rawbase);
+            slapi_ch_free_string(&rawbase);
             return;
         }
     }
 
+    if (rawbase && strlen(rawbase) == 0 && scope != LDAP_SCOPE_BASE) {
+        /* This is not a Root DSE search, so map it to the default naming context */
+        const char *default_basedn = config_get_default_naming_context();
+        if (default_basedn) {
+            slapi_ch_free_string(&rawbase);
+            rawbase = slapi_ch_strdup(default_basedn);
+        }
+    }
+
     /* If anonymous access is only allowed for searching the root DSE,
      * we need to reject any other anonymous search attempts. */
     if ((slapi_sdn_get_dn(&(operation->o_sdn)) == NULL) &&