import fix of slapd parsing of auth{cz} "dn:<pat>" rules from HEAD

diff --git a/CHANGES b/CHANGES
index 6b91c3c2e59c71686198b9112ce3f1c7c22810e1..394cfd5e1370177d3299b094c59a8fe68e97a402 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,7 @@
 OpenLDAP 2.2 Change Log
 
 OpenLDAP 2.2.12 Engineering
+       Fixed slapd parsing of auth{cz} "dn:<pat>" rules
        Fixed slapd set acl recursion (ITS#3140)
        Fixed slapd first component bug (ITS#3118)
        Fixed slapd TOLOWER macro use bug (ITS#3115)

diff --git a/servers/slapd/saslauthz.c b/servers/slapd/saslauthz.c
index e08cdd9bd6ab1f7ef866d5c6fc54b31c983cff41..d38ad64079a38f7b49caa59cf05c2be89696596b 100644 (file)
--- a/servers/slapd/saslauthz.c
+++ b/servers/slapd/saslauthz.c
@@ -211,35 +211,36 @@ static int slap_parseURI( Operation *op, struct berval *uri,
                        bv.bv_val++;
 
                        if ( !strncasecmp( bv.bv_val, "exact:", sizeof( "exact:" ) - 1 ) ) {
-                               bv.bv_val += sizeof( "exact" ) - 1;
+                               bv.bv_val += sizeof( "exact:" ) - 1;
                                *scope = LDAP_X_SCOPE_EXACT;
 
                        } else if ( !strncasecmp( bv.bv_val, "regex:", sizeof( "regex:" ) - 1 ) ) {
-                               bv.bv_val += sizeof( "regex" ) - 1;
+                               bv.bv_val += sizeof( "regex:" ) - 1;
                                *scope = LDAP_X_SCOPE_REGEX;
 
                        } else if ( !strncasecmp( bv.bv_val, "children:", sizeof( "chldren:" ) - 1 ) ) {
-                               bv.bv_val += sizeof( "children" ) - 1;
+                               bv.bv_val += sizeof( "children:" ) - 1;
                                *scope = LDAP_X_SCOPE_CHILDREN;
 
                        } else if ( !strncasecmp( bv.bv_val, "subtree:", sizeof( "subtree:" ) - 1 ) ) {
-                               bv.bv_val += sizeof( "subtree" ) - 1;
+                               bv.bv_val += sizeof( "subtree:" ) - 1;
                                *scope = LDAP_X_SCOPE_SUBTREE;
 
                        } else if ( !strncasecmp( bv.bv_val, "onelevel:", sizeof( "onelevel:" ) - 1 ) ) {
-                               bv.bv_val += sizeof( "onelevel" ) - 1;
+                               bv.bv_val += sizeof( "onelevel:" ) - 1;
                                *scope = LDAP_X_SCOPE_ONELEVEL;
 
                        } else {
                                return LDAP_PROTOCOL_ERROR;
                        }
+               } else {
+                       if ( bv.bv_val[ 0 ] != ':' ) {
+                               return LDAP_PROTOCOL_ERROR;
+                       }
+                       *scope = LDAP_X_SCOPE_EXACT;
+                       bv.bv_val++;
                }
 
-               if ( bv.bv_val[ 0 ] != ':' ) {
-                       return LDAP_PROTOCOL_ERROR;
-               }
-               bv.bv_val++;
-
                bv.bv_val += strspn( bv.bv_val, " " );
                /* jump here in case no type specification was present
                 * and uir was not an URI... HEADS-UP: assuming EXACT */