Bug 1714247

Summary: ACI rule with ip=* denies IPv6 addresses
Product: Red Hat Enterprise Linux 8 Reporter: Viktor Ashirov <vashirov>
Component: 389-ds-baseAssignee: mreynolds
Status: CLOSED WONTFIX QA Contact: RHDS QE <ds-qe-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.1CC: lkrispen, mhonek, nkinder, rmeggins, spichugi, tbordaz, vashirov
Target Milestone: rc   
Target Release: 8.1   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-05-30 06:43:18 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
ipv4
none
ipv6 none

Description Viktor Ashirov 2019-05-27 13:43:40 UTC 
Description of problem:
ACI bind rule with ip keyword evaluates as DENY for IPv6 connections

Version-Release number of selected component (if applicable):
389-ds-base-1.4.1.3-1.module+el8.1.0+3259+a5bc8ad3.x86_64


How reproducible:
always

Steps to Reproduce:
1. tests/suites/acl/keywords_test.py::test_user_can_access_the_data_when_connecting_from_any_machine_2

Actual results:
see attached errors log

Expected results:
ip=* should allow IPv6 addresses.

Additional info:
Comment 1 Viktor Ashirov 2019-05-27 13:44:26 UTC 
Created attachment 1573929 [details]
ipv4
Comment 2 Viktor Ashirov 2019-05-27 13:44:44 UTC 
Created attachment 1573930 [details]
ipv6
Comment 5 mreynolds 2019-05-29 16:30:28 UTC 
The problem here is that the code has no idea that ip="*" is a IPv4 or IPv6 wildcard.  It would require a major change to the code to get this to work.  Is there a valid use case for ip="*"?  If not I'd like to close this as won't fix.
Comment 6 Viktor Ashirov 2019-05-30 06:43:18 UTC 
I can only think of denying a specific user to connect over network, but allowing over ldapi. But in this case the deny rule works. It's only 'allow IPv6 via ip=*' that fails.

Let's close it as WONTFIX. I will submit a PR to upstream to adjust the test so it won't affect package gating.
Thanks!