Add referral scope checks (ITS#1289) from dshriver@sharemedia.com

diff --git a/servers/slapd/back-ldbm/search.c b/servers/slapd/back-ldbm/search.c
index b4a9a29fb3c25af0f55d539a3291e789912cb7b2..5e0d46fd738ecdb9f080845a8b30fb47b71b03bd 100644 (file)
--- a/servers/slapd/back-ldbm/search.c
+++ b/servers/slapd/back-ldbm/search.c
@@ -348,13 +348,50 @@ searchit:
                if ( !manageDSAit && scope != LDAP_SCOPE_BASE &&
                        is_entry_referral( e ) )
                {
-                       struct berval **refs = get_entry_referrals(
-                               be, conn, op, e );
+                       char    *dn;
 
-                       send_search_reference( be, conn, op,
-                               e, refs, scope, NULL, &v2refs );
+                       /* check scope */
+                       if ( !scopeok && scope == LDAP_SCOPE_ONELEVEL ) {
+                               if ( (dn = dn_parent( be, e->e_ndn )) != NULL ) {
+                                       (void) dn_normalize( dn );
+                                       scopeok = (dn == realbase)
+                                               ? 1
+                                               : (strcmp( dn, realbase ) ? 0 : 1 );
+                                       free( dn );
 
-                       ber_bvecfree( refs );
+                               } else {
+                                       scopeok = (realbase == NULL || *realbase == '\0');
+                               }
+
+                       } else if ( !scopeok && scope == LDAP_SCOPE_SUBTREE ) {
+                               dn = ch_strdup( e->e_ndn );
+                               scopeok = dn_issuffix( dn, realbase );
+                               free( dn );
+
+                       } else {
+                               scopeok = 1;
+                       }
+
+                       if( scopeok ) {
+                               struct berval **refs = get_entry_referrals(
+                                       be, conn, op, e );
+
+                               send_search_reference( be, conn, op,
+                                       e, refs, scope, NULL, &v2refs );
+
+                               ber_bvecfree( refs );
+
+                       } else {
+#ifdef NEW_LOGGING
+                               LDAP_LOG(( "backend", LDAP_LEVEL_DETAIL2,
+                                       "ldbm_search: candidate referral %ld scope not okay\n",
+                                       id ));
+#else
+                               Debug( LDAP_DEBUG_TRACE,
+                                       "ldbm_search: candidate referral %ld scope not okay\n",
+                                       id, 0, 0 );
+#endif
+                       }
 
                        goto loop_continue;
                }