OpenLDAP
Up to top level
Build   Contrib   Development   Documentation   Historical   Incoming   Software Bugs   Software Enhancements   Web  

Logged in as guest

Viewing Software Bugs/5402
Full headers

From: norbert@rittel.de
Subject: Sets: Hyphens within attribute names considered as separate tokens
Compose comment
Download message
State:
0 replies:
2 followups: 1 2

Major security issue: yes  no

Notes:

Notification:


Date: Thu, 6 Mar 2008 13:38:48 GMT
From: norbert@rittel.de
To: openldap-its@OpenLDAP.org
Subject: Sets: Hyphens within attribute names considered as separate tokens
Full_Name: Norbert Rittel
Version: 2.3.27
OS: Mac OS X Server 10.5.2
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (217.91.71.78)


When using attribute names containing hyphens the Set code erroneously considers
the parts to either side of the hyphen as separate tokens.

For example a <by> clause like

    by set.exact="this/apple-keyword & user/apple-keyword" read

always yields an empty set. This means that on Apple Open Directory servers set
clauses canot be used with any Apple-supplied attribute as they all begin with
"apple-".

Pierangelo Masarati was so kind to verify that this bug is still present in the
latest release. Hopefully the fix is a simple diff that we can apply to the
older version shipping with Mac OS X Server, too. :-)


Followup 1

Download message
Date: Thu, 06 Mar 2008 23:32:14 +0100
From: Pierangelo Masarati <ando@sys-net.it>
To: norbert@rittel.de
CC: openldap-its@openldap.org
Subject: Re: (ITS#5402) Sets: Hyphens within attribute names considered as
 separate tokens
norbert@rittel.de wrote:

> When using attribute names containing hyphens the Set code erroneously
considers
> the parts to either side of the hyphen as separate tokens.
> 
> For example a <by> clause like
> 
>     by set.exact="this/apple-keyword & user/apple-keyword" read
> 
> always yields an empty set. This means that on Apple Open Directory servers
set
> clauses canot be used with any Apple-supplied attribute as they all begin
with
> "apple-".

The code that parses attribute descriptions appears to be definitely
broken, since it does allow underscores but no hyphens, and it does not
allow digits in attribute descriptions (including OIDs).  This should be
fixed now in HEAD, and the patch

servers/slapd/sets.c 1.41 -> 1.42

seems to apply to current re24 and re23 without much hassle.

Please test, p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
---------------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati@sys-net.it
---------------------------------------




Followup 2

Download message
Date: Sat, 08 Mar 2008 09:26:45 +0100
From: Pierangelo Masarati <ando@sys-net.it>
To: Norbert Rittel <norbert@rittel.de>
CC: openldap-its@openldap.org
Subject: Re: (ITS#5402) Sets: Hyphens within attribute names considered as
 separate tokens
Since the ITS' purpose consists in helping tracking issues,
please keep it in CC in replies, otherwise you defeat its purpose.

Norbert Rittel wrote:

> Am 06.03.2008 um 23:32 schrieb Pierangelo Masarati:
> 
>> The code that parses attribute descriptions appears to be definitely
>> broken, since it does allow underscores but no hyphens, and it does not
>> allow digits in attribute descriptions (including OIDs).  This should
be
>> fixed now in HEAD, and the patch
>>
>> servers/slapd/sets.c 1.41 -> 1.42
>>
>> seems to apply to current re24 and re23 without much hassle.
>>
>> Please test, p.
> 
> Wow, really great turnaround :-)
> 
> To test I've downloaded the current OpenLDAP sources used in Mac OS X
> 10.5.2 from Apple's site at
> 
> http://www.opensource.apple.com/darwinsource/10.5.2/
> 
> But unfortunately issuing a 'make' (on the unaltered source already)
> results in an error (config.log enclosed if you want to take a look).
> I've sent a follow-up to Apple, with A LOT of luck someone at
> engineering there will come back to me on that.
> 
> If you have access to a Mac OS X (Server) box you might want to give it
> a try, but I fully understand if this is not the platform you're working
> on ;-)

This error appears to have nothing to do with the proposed fix,
so you should rather post to OpenLDAP-software (and, only in case
another issue surfaces, file a separate ITS).

I do not develop on that platform, nor I have access to it, so
I'm afraid I can't help.

p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
---------------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati@sys-net.it
---------------------------------------



Up to top level
Build   Contrib   Development   Documentation   Historical   Incoming   Software Bugs   Software Enhancements   Web  

Logged in as guest


The OpenLDAP Issue Tracking System uses a hacked version of JitterBug

______________
© Copyright 2013, OpenLDAP Foundation, info@OpenLDAP.org