Bug 822700

Summary: Bad DNs in ACIs can segfault ns-slapd
Product: Red Hat Enterprise Linux 6 Reporter: Rich Megginson <rmeggins>
Component: 389-ds-baseAssignee: Rich Megginson <rmeggins>
Status: CLOSED ERRATA QA Contact: IDM QE LIST <seceng-idm-qe-list>
Severity: unspecified Docs Contact:
Priority: urgent    
Version: 6.3CC: amsharma, jgalipea, nkinder
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 389-ds-base-1.2.10.2-13.el6 Doc Type: Bug Fix
Doc Text:
Cause: A bad DN in a userdn/groupdn/other dn in an aci would cause the server to crash during startup or after an online import Consequence: Server could not be started until the offending aci was fixed an re-imported offline Fix: The code rejects bad DNs Result: Bad DNs are rejected by the aci handling code and the server does not crash
 Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-20 07:15:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Rich Megginson 2012-05-17 20:08:44 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/361

Version 1.2.10 segfaults on start up if an ACI has an bad DN. The segmentation fault occurs during the parsing of the ACI in function __aclp__copy_normalized_str. I tracked the defect to this commit:

http://git.fedorahosted.org/git/?p=389/ds.git;a=commitdiff;h=f6397113666f06848412bb12f754f04258cfa5fa

A bad DN can will make the DN normalization fail which is not tested any more. I am attaching a trivial patch that tests for this case and returns -1 when the normalization failed, thus restoring the previous behaviour of the function.
Comment 2 Rich Megginson 2012-05-18 02:16:38 UTC 
RHEL63
r6532 | rmeggins | 2012-05-17 19:44:42 -0600 (Thu, 17 May 2012) | 3 lines

added test for https://bugzilla.redhat.com/show_bug.cgi?id=822700
https://fedorahosted.org/389/ticket/361

acl/syntax.sh

trunk
r6533 | rmeggins | 2012-05-17 20:15:53 -0600 (Thu, 17 May 2012) | 3 lines

added test for https://bugzilla.redhat.com/show_bug.cgi?id=822700
https://fedorahosted.org/389/ticket/361
Comment 3 Rich Megginson 2012-05-18 02:39:41 UTC 
To ssh://rmeggins.redhat.com/rpms/389-ds-base
   dfa26bf..0125409  rhel-6.3 -> rhel-6.3
Comment 5 Rich Megginson 2012-05-18 02:54:31 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause:  A bad DN in a userdn/groupdn/other dn in an aci would cause the server to crash during startup or after an online import
Consequence: Server could not be started until the offending aci was fixed an re-imported offline
Fix: The code rejects bad DNs
Result: Bad DNs are rejected by the aci handling code and the server does not crash
Comment 6 Amita Sharma 2012-05-21 11:57:23 UTC 
Executed test "ticket361" in acl/syntax.sh
AND

quickinstall startup 	100% (2/2) 	  	 
Acl startup(o=ace industry,c=us) 	100% (1/1) 	  	 
Acl run(o=ace industry,c=us) 	100% (1/1) 	  	 
Acl cleanup 	100% (1/1) 	 

So marking the test as PASSED.
Comment 7 errata-xmlrpc 2012-06-20 07:15:44 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0813.html