389-ds-base

#51245 Ticket 51244 - On ADD replication URP issue internal searches with filter containing unescaped chars
Closed by spichugi. Opened by tbordaz.
tbordaz/389-ds-base ticket_51244  into  master

Download 51245.patch

Bug description:
In MMR a consumer receiving a ADD has to do some checking based on basedn.
It checks if the entry was a tombstone or if the conflicting parent entry was a tombstone.

To do this checking, URP does internal searches using basedn.
A '*' (ASTERISK) is valid in a RDN and in a DN. But using a DN in an assertionvalue of a filter, the ASTERISK needs to be escaped else the server will interprete the filtertype to be a substring. (see
https://tools.ietf.org/html/rfc4515#section-3)
The problem is that if a added entry contains an ASTERISK in the DN, it will not be escaped in internal search and trigger substring search (likely unindexed).

Fix description:
escape the DN before doing internal search in URP

https://pagure.io/389-ds-base/issue/51244

Reviewed by: ?

Platforms tested: F31

Code looks good, but I thought you could have used: filter_escape_filter_value() Maybe not?

rebased onto d7c5cc54c412d11e28c05f36ed44826e1b75030c

@mreynolds thanks for reviewing.

Thanks for the tip. It took me some time to make it work using filter_escape_filter_value but I think it is the right approach. I updated the patch.

rebased onto fa025b89f29ae1673dee400c51a37a6f7fd76776

@mreynolds, I rebase the PR. do you mind to review it again :)

This seems clearer, good job. I'll leave it to @mreynolds to finish review though :)

please use slapi_ch_free_string()

please use slapi_ch_free_string() here too! Thanks!

Two minor issues, but ack!! Yeah this code looks a lot better using the filter escape functions, thanks!

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/4298

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.